Files
poky/meta/recipes-devtools/subversion/subversion/subversion-CVE-2013-1849.patch
Yue Tao 4fc1cff43b subversion: fix for Security Advisory CVE-2013-1849
Reject operations on getcontentlength and getcontenttype properties
if the resource is an activity.

(From OE-Core rev: 94e8b503e8a5ae476037d4aa86f8e27d4a8c23ea)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:08:59 +01:00

26 lines
1.0 KiB
Diff

Upstream-Status: Backport
--- a/subversion/mod_dav_svn/liveprops.c
+++ b/subversion/mod_dav_svn/liveprops.c
@@ -410,7 +410,8 @@ insert_prop(const dav_resource *resource
svn_filesize_t len = 0;
/* our property, but not defined on collection resources */
- if (resource->collection || resource->baselined)
+ if (resource->type == DAV_RESOURCE_TYPE_ACTIVITY
+ || resource->collection || resource->baselined)
return DAV_PROP_INSERT_NOTSUPP;
serr = svn_fs_file_length(&len, resource->info->root.root,
@@ -434,7 +435,9 @@ insert_prop(const dav_resource *resource
svn_string_t *pval;
const char *mime_type = NULL;
- if (resource->baselined && resource->type == DAV_RESOURCE_TYPE_VERSION)
+ if (resource->type == DAV_RESOURCE_TYPE_ACTIVITY
+ || (resource->baselined
+ && resource->type == DAV_RESOURCE_TYPE_VERSION))
return DAV_PROP_INSERT_NOTSUPP;
if (resource->type == DAV_RESOURCE_TYPE_PRIVATE