head 1.9; access; symbols pkgsrc-2013Q2:1.9.0.8 pkgsrc-2013Q2-base:1.9 pkgsrc-2012Q4:1.9.0.6 pkgsrc-2012Q4-base:1.9 pkgsrc-2011Q4:1.9.0.4 pkgsrc-2011Q4-base:1.9 pkgsrc-2011Q2:1.9.0.2 pkgsrc-2011Q2-base:1.9 pkgsrc-2010Q4:1.8.0.8 pkgsrc-2010Q4-base:1.8 pkgsrc-2010Q3:1.8.0.6 pkgsrc-2010Q3-base:1.8 pkgsrc-2010Q2:1.8.0.4 pkgsrc-2010Q1:1.8.0.2 pkgsrc-2009Q4:1.7.0.46 pkgsrc-2009Q4-base:1.7 pkgsrc-2008Q4:1.7.0.44 pkgsrc-2008Q4-base:1.7 pkgsrc-2008Q3:1.7.0.42 pkgsrc-2008Q3-base:1.7 cube-native-xorg:1.7.0.40 cube-native-xorg-base:1.7 pkgsrc-2008Q2:1.7.0.38 pkgsrc-2008Q2-base:1.7 pkgsrc-2008Q1:1.7.0.36 pkgsrc-2008Q1-base:1.7 pkgsrc-2007Q4:1.7.0.34 pkgsrc-2007Q4-base:1.7 pkgsrc-2007Q3:1.7.0.32 pkgsrc-2007Q3-base:1.7 pkgsrc-2007Q2:1.7.0.30 pkgsrc-2007Q2-base:1.7 pkgsrc-2007Q1:1.7.0.28 pkgsrc-2007Q1-base:1.7 pkgsrc-2006Q4:1.7.0.26 pkgsrc-2006Q4-base:1.7 pkgsrc-2006Q3:1.7.0.24 pkgsrc-2006Q3-base:1.7 pkgsrc-2006Q2:1.7.0.22 pkgsrc-2006Q2-base:1.7 pkgsrc-2006Q1:1.7.0.20 pkgsrc-2006Q1-base:1.7 pkgsrc-2005Q4:1.7.0.18 pkgsrc-2005Q4-base:1.7 pkgsrc-2005Q3:1.7.0.16 pkgsrc-2005Q3-base:1.7 pkgsrc-2005Q2:1.7.0.14 pkgsrc-2005Q2-base:1.7 pkgsrc-2005Q1:1.7.0.12 pkgsrc-2005Q1-base:1.7 pkgsrc-2004Q4:1.7.0.10 pkgsrc-2004Q4-base:1.7 pkgsrc-2004Q3:1.7.0.8 pkgsrc-2004Q3-base:1.7 pkgsrc-2004Q2:1.7.0.6 pkgsrc-2004Q2-base:1.7 pkgsrc-2004Q1:1.7.0.4 pkgsrc-2004Q1-base:1.7 pkgsrc-2003Q4:1.7.0.2 pkgsrc-2003Q4-base:1.7 buildlink2-base:1.7 netbsd-1-5-RELEASE:1.5 netbsd-1-4-PATCH003:1.5 pkgsrc-base:1.1.1.1 TNF:1.1.1; locks; strict; comment @# @; 1.9 date 2011.01.21.23.34.14; author wiz; state dead; branches; next 1.8; 1.8 date 2010.07.01.18.50.15; author tron; state Exp; branches 1.8.2.1 1.8.4.1; next 1.7; 1.7 date 2001.05.01.00.31.25; author kei; state dead; branches; next 1.6; 1.6 date 2001.03.31.09.21.17; author itojun; state Exp; branches; next 1.5; 1.5 date 2000.10.14.01.22.42; author itojun; state Exp; branches; next 1.4; 1.4 date 2000.08.15.03.42.22; author itojun; state Exp; branches; next 1.3; 1.3 date 99.09.28.07.20.47; author sakamoto; state dead; branches; next 1.2; 1.2 date 99.09.27.11.18.59; author agc; state Exp; branches; next 1.1; 1.1 date 99.09.27.05.37.36; author sakamoto; state Exp; branches 1.1.1.1; next ; 1.8.2.1 date 2010.07.01.18.50.15; author spz; state dead; branches; next 1.8.2.2; 1.8.2.2 date 2010.07.02.09.22.04; author spz; state Exp; branches; next ; 1.8.4.1 date 2010.07.01.18.50.15; author agc; state dead; branches; next 1.8.4.2; 1.8.4.2 date 2010.07.04.07.28.54; author agc; state Exp; branches; next ; 1.1.1.1 date 99.09.27.05.37.36; author sakamoto; state Exp; branches; next ; desc @@ 1.9 log @Update w3m and w3m-img to 0.5.3. Some pkglint cleanup and DESCR rewording while here. XXX: I don't see what w3m-img does differently? Changes: w3m 0.5.3 - 2011-01-15 * security fix - fix vulnerabilities indicated by bugs.debian.org. - suppress sending Referer, if https:// -> http:// * new features - adapt w3mimg to native windows on MS Windows. - support xterm-incompatible terminals without gpm. - add "xhtml" to default guess. - introduce option pseudo_inlines. - add option to avoid "wrong number of dots" error in cookies. * other bug fixes - fix "important" bugs from bugs.debian.org - preserve spaces in multibyte context. - fix proxy authentication. @ text @$NetBSD: patch-ad,v 1.8 2010/07/01 18:50:15 tron Exp $ Fix for CVE-2010-2074 taken from here: http://www.openwall.com/lists/oss-security/2010/06/14/4 --- istream.c.orig 2007-05-23 16:06:05.000000000 +0100 +++ istream.c 2010-07-01 19:31:00.000000000 +0100 @@@@ -447,8 +447,17 @@@@ if (!seen_dnsname) seen_dnsname = Strnew(); + /* replace \0 to make full string visible to user */ + if (sl != strlen(sn)) { + int i; + for (i = 0; i < sl; ++i) { + if (!sn[i]) + sn[i] = '!'; + } + } Strcat_m_charp(seen_dnsname, sn, " ", NULL); - if (ssl_match_cert_ident(sn, sl, hostname)) + if (sl == strlen(sn) /* catch \0 in SAN */ + && ssl_match_cert_ident(sn, sl, hostname)) break; } } @@@@ -466,16 +475,27 @@@@ if (match_ident == FALSE && ret == NULL) { X509_NAME *xn; char buf[2048]; + int slen; xn = X509_get_subject_name(x); - if (X509_NAME_get_text_by_NID(xn, NID_commonName, - buf, sizeof(buf)) == -1) + slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)); + if ( slen == -1) /* FIXME: gettextize? */ ret = Strnew_charp("Unable to get common name from peer cert"); - else if (!ssl_match_cert_ident(buf, strlen(buf), hostname)) + else if (slen != strlen(buf) + || !ssl_match_cert_ident(buf, strlen(buf), hostname)) { + /* replace \0 to make full string visible to user */ + if (slen != strlen(buf)) { + int i; + for (i = 0; i < slen; ++i) { + if (!buf[i]) + buf[i] = '!'; + } + } /* FIXME: gettextize? */ ret = Sprintf("Bad cert ident %s from %s", buf, hostname); + } else match_ident = TRUE; } @ 1.8 log @Add patch by Ludwig Nussel to fix the certificate spoofing vulnerability reported in CVE-2010-2074. @ text @d1 1 a1 1 $NetBSD$ @ 1.8.4.1 log @file patch-ad was added on branch pkgsrc-2010Q2 on 2010-07-04 07:28:54 +0000 @ text @d1 58 @ 1.8.4.2 log @Pullup previous changes on HEAD to pkgsrc-2010Q2 branch to fix branching error, and to sync with reality. @ text @a0 58 $NetBSD: patch-ad,v 1.8 2010/07/01 18:50:15 tron Exp $ Fix for CVE-2010-2074 taken from here: http://www.openwall.com/lists/oss-security/2010/06/14/4 --- istream.c.orig 2007-05-23 16:06:05.000000000 +0100 +++ istream.c 2010-07-01 19:31:00.000000000 +0100 @@@@ -447,8 +447,17 @@@@ if (!seen_dnsname) seen_dnsname = Strnew(); + /* replace \0 to make full string visible to user */ + if (sl != strlen(sn)) { + int i; + for (i = 0; i < sl; ++i) { + if (!sn[i]) + sn[i] = '!'; + } + } Strcat_m_charp(seen_dnsname, sn, " ", NULL); - if (ssl_match_cert_ident(sn, sl, hostname)) + if (sl == strlen(sn) /* catch \0 in SAN */ + && ssl_match_cert_ident(sn, sl, hostname)) break; } } @@@@ -466,16 +475,27 @@@@ if (match_ident == FALSE && ret == NULL) { X509_NAME *xn; char buf[2048]; + int slen; xn = X509_get_subject_name(x); - if (X509_NAME_get_text_by_NID(xn, NID_commonName, - buf, sizeof(buf)) == -1) + slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)); + if ( slen == -1) /* FIXME: gettextize? */ ret = Strnew_charp("Unable to get common name from peer cert"); - else if (!ssl_match_cert_ident(buf, strlen(buf), hostname)) + else if (slen != strlen(buf) + || !ssl_match_cert_ident(buf, strlen(buf), hostname)) { + /* replace \0 to make full string visible to user */ + if (slen != strlen(buf)) { + int i; + for (i = 0; i < slen; ++i) { + if (!buf[i]) + buf[i] = '!'; + } + } /* FIXME: gettextize? */ ret = Sprintf("Bad cert ident %s from %s", buf, hostname); + } else match_ident = TRUE; } @ 1.8.2.1 log @file patch-ad was added on branch pkgsrc-2010Q1 on 2010-07-02 09:22:04 +0000 @ text @d1 58 @ 1.8.2.2 log @Pullup ticket 3153 - requested by tron security patch Revisions pulled up: - pkgsrc/www/w3m/Makefile 1.58 - pkgsrc/www/w3m/distinfo 1.21 - pkgsrc/www/w3m-img/Makefile 1.20 Files added: pkgsrc/www/w3m/patches/patch-ac pkgsrc/www/w3m/patches/patch-ad ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: tron Date: Thu Jul 1 18:50:15 UTC 2010 Modified Files: pkgsrc/www/w3m: Makefile distinfo pkgsrc/www/w3m-img: Makefile Added Files: pkgsrc/www/w3m/patches: patch-ac patch-ad Log Message: Add patch by Ludwig Nussel to fix the certificate spoofing vulnerability reported in CVE-2010-2074. To generate a diff of this commit: cvs rdiff -u -r1.57 -r1.58 pkgsrc/www/w3m/Makefile cvs rdiff -u -r1.20 -r1.21 pkgsrc/www/w3m/distinfo cvs rdiff -u -r1.19 -r1.20 pkgsrc/www/w3m-img/Makefile cvs rdiff -u -r0 -r1.14 pkgsrc/www/w3m/patches/patch-ac cvs rdiff -u -r0 -r1.8 pkgsrc/www/w3m/patches/patch-ad @ text @a0 58 $NetBSD: patch-ad,v 1.8 2010/07/01 18:50:15 tron Exp $ Fix for CVE-2010-2074 taken from here: http://www.openwall.com/lists/oss-security/2010/06/14/4 --- istream.c.orig 2007-05-23 16:06:05.000000000 +0100 +++ istream.c 2010-07-01 19:31:00.000000000 +0100 @@@@ -447,8 +447,17 @@@@ if (!seen_dnsname) seen_dnsname = Strnew(); + /* replace \0 to make full string visible to user */ + if (sl != strlen(sn)) { + int i; + for (i = 0; i < sl; ++i) { + if (!sn[i]) + sn[i] = '!'; + } + } Strcat_m_charp(seen_dnsname, sn, " ", NULL); - if (ssl_match_cert_ident(sn, sl, hostname)) + if (sl == strlen(sn) /* catch \0 in SAN */ + && ssl_match_cert_ident(sn, sl, hostname)) break; } } @@@@ -466,16 +475,27 @@@@ if (match_ident == FALSE && ret == NULL) { X509_NAME *xn; char buf[2048]; + int slen; xn = X509_get_subject_name(x); - if (X509_NAME_get_text_by_NID(xn, NID_commonName, - buf, sizeof(buf)) == -1) + slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)); + if ( slen == -1) /* FIXME: gettextize? */ ret = Strnew_charp("Unable to get common name from peer cert"); - else if (!ssl_match_cert_ident(buf, strlen(buf), hostname)) + else if (slen != strlen(buf) + || !ssl_match_cert_ident(buf, strlen(buf), hostname)) { + /* replace \0 to make full string visible to user */ + if (slen != strlen(buf)) { + int i; + for (i = 0; i < slen; ++i) { + if (!buf[i]) + buf[i] = '!'; + } + } /* FIXME: gettextize? */ ret = Sprintf("Bad cert ident %s from %s", buf, hostname); + } else match_ident = TRUE; } @ 1.7 log @As per request of itojun and hubertf, rename w3m-m17n as w3m. It reduces our maintenance cost. Approved by agc. @ text @d1 1 a1 1 $NetBSD: patch-ad,v 1.6 2001/03/31 09:21:17 itojun Exp $ d3 30 a32 5 --- rc.c.orig Fri Mar 23 10:51:04 2001 +++ rc.c Fri Mar 30 21:07:29 2001 @@@@ -51,7 +51,7 @@@@ #endif #define P_PIXELS 8 d34 1 a34 33 -#if LANG == JA +#if KANJI_SYMBOL #define CMT_HELPER "外部ビューアの編集" #define CMT_TABSTOP "タブ幅" #define CMT_PIXEL_PER_CHAR "文字幅 (4.0...32.0)" @@@@ -146,7 +146,7 @@@@ #define CMT_PAGERLINE "# of reserved line when w3m is used as a pager" #define CMT_HISTSIZE "# of reserved URL" #define CMT_SAVEHIST "Save URL history" -/* #define CMT_KANJICODE "Display Kanji Code" */ +#define CMT_KANJICODE "Display Kanji Code" #define CMT_FRAME "Automatic rendering of frame" #define CMT_TSELF "use _self as default target" #define CMT_DISPLINK "Automatic display of link URL" @@@@ -184,7 +184,7 @@@@ #define CMT_FTPPASS "Password for FTP(use your mail address)" #define CMT_USERAGENT "User-Agent" #define CMT_ACCEPTLANG "Accept-Language" -/* #define CMT_DOCUMENTCODE "Document Charset" */ +#define CMT_DOCUMENTCODE "Document Charset" #define CMT_WRAP "Wrap search" #define CMT_VIEW_UNSEENOBJECTS "Display unseenobjects (e.g. bgimage) tag" #ifdef __EMX__ @@@@ -260,7 +260,7 @@@@ #ifdef COLOR static struct sel_c colorstr[] = { -#if LANG == JA +#if KANJI_SYMBOL {0, "black", "黒"}, {1, "red", "赤"}, {2, "green", "緑"}, @@@@ -442,7 +442,7 @@@@ d36 23 a58 7 struct param_section sections[] = { -#if LANG == JA +#if KANJI_SYMBOL {"表示関係", params1}, #ifdef COLOR {"表示色", params2}, @ 1.6 log @upgrade to 0.2.1. 2001/3/23 ============================================================== From: Hironori Sakamoto Subject: [w3m-dev 01807] Re: w3m-0.2.0 * url.c doesn't compile when USE_NNTP or __EMX__ is defined. * patch for EWS4800 * when #define USE_SSL and #undef USE_SSL_VERIFY, rc.c and url.c doesn't compile. (problems about ssl_forbid_method) * when saveBufferDelNum and del==TRUE, patterns before ":" are deleted twice. * bugfix about saving history. From: TSUCHIYA Masatoshi Subject: [w3m-dev 01810] deflate (was: w3m-0.2.0) deflate patch in 0.2.0 doesn't work on http://cvs.m17n.org/~akr/diary/ . From: Fumitoshi UKAI Subject: [w3m-dev 01808] Re: w3m-0.2.0 w3m doesn't compile on GNU/Linux and glibc2.2 because it lacks sin.ss_len. From: Hironori Sakamoto Subject: [w3m-dev-en 00399] Re: w3m-0.2.0 >> From: Dan Fandrich >> Version 0.2.0 still contains the following bugs which I fixed two months >> ago and sent patches for to this list, namely: >> - core dumps on startup if given a URL requiring a needsterminal mailcap >> handler >> - destroys most of an existing ~/.mailcap file without warning when editing >> - mailcap handling is still wrong as MIME type should be case insensitive >> - private mailcap extension has an illegal name From: SATO Seichi Subject: w3m regex bugs w3m coredumps when passing $* as a search string. 2001/3/22 ============================================================== From: Hironori Sakamoto Subject: [w3m-dev 01664] Re: Patch for anonymizer.com Don't call cleanupName() when the URL is http:///: ... From: Hironori Sakamoto Subject: [w3m-dev 01670] Re: w3m-0.1.11-pre-kokb24-test1 strcpy/strncpy in Str.c are replaced with bcopy. From: TSUCHIYA Masatoshi Subject: [w3m-dev 01618] backend patch Subject: [w3m-dev 01671] backend patch for w3m-0.1.11-pre-kokb24-test1 A patch for w3m to work as a client. (-backend patch) From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01673] SEGV in append_frame_info() Improvement of illegal frame handling. From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01674] image map w3m doesn't follow anchors from client-side image map when the URLs are like "#test". From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01675] goto label Changed w3m not to reload the document when following label-only URL like #label. From: Tsutomu Okada Subject: [w3m-dev 01676] Re: w3m-0.1.11-pre-kokb24-test1 Subject: [w3m-dev 01678] Re: w3m-0.1.11-pre-kokb24-test1 From: Hironori Sakamoto Subject: [w3m-dev 01680] Re: w3m-0.1.11-pre-kokb24-test1 To remove the compiler warnings From: Hironori Sakamoto Subject: [w3m-dev 01684] Re: http://cvs.m17n.org/~akr/diary/ application/x-deflate support. From: Moritz Barsnick Subject: [w3m-dev-en 00318] Information about current page Subject: [w3m-dev-en 00320] Re: Information about current page Subject: [w3m-dev-en 00322] Re: Information about current page Subject: [w3m-dev-en 00323] Buglet (Was: Re: Information about current page) Changes 'URL of the current anchor' on the info page into 'full' URL. When the cursor is on a form element, `Method/type of current form' will be displayed. From: c603273@@vus069.trl.telstra.com.au (Brian Keck) Subject: [w3m-dev-en 00343] patch for proxy user:passwd on command line Subject: [w3m-dev-en 00351] Re: patch for proxy user:passwd on command line This patch to w3m-0.1.11-pre-kokb23 adds the lynx-like option -pauth username:password so I don't have to retype username & password every time I run w3m, which is often. It's so simple I wonder whether it's against policy, but it would be nice for me & some others if it was in the official 0.1.11. From: Hironori Sakamoto Subject: [w3m-dev 01772] Re: visited anchor Subject: [w3m-dev 01773] Re: visited anchor * visited anhor color support. * textlist based history implementation. * history URLs are stored in a hash table. * the implementation of rules are changed. From: Hironori Sakamoto Subject: [w3m-dev 01786] Re: w3m-0.1.11-pre-hsaka24 Subject: [w3m-dev 01787] Re: w3m-0.1.11-pre-hsaka24 * Improvement of illegal frame handling. From: Hironori Sakamoto Subject: [w3m-dev 01788] Re: w3m-0.1.11-pre-hsaka24 From: Hironori Sakamoto Subject: [w3m-dev 01792] Re: w3m-0.1.11-pre-hsaka24 search algorithm in retrieveAnchor() is changed from linear search to binary search. From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01793]
  • make type attribute of
  • tag effective not only for the
  • element but also for all
  • tags that follows the first type-specified
  • tag. From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01801] some fixes. Bugfix of frame Subject: IPv6 support for w3m's ftp From: Hajimu UMEMOTO IPv6 support for FTP. 2001/3/16 ============================================================= From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01711] Authorization * http://user:pass@@hostname/ support. From: hsaka@@mth.biglobe.ne.jp Subject: [w3m-dev 01724] buf->type when mailcap is used. From: hsaka@@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: [w3m-dev 01726] anchor jump too slow by TAB-key on STDIN. * when moving from anchor to anchor by TAB on the document read from stdin, the movement is very slow because currentdir() is invoked on each TAB. From: sakane@@d4.bsd.nes.nec.co.jp (Yoshinobu Sakane) Subject: [w3m-dev 01727] C-z when stdin From: Hironori Sakamoto Subject: [w3m-dev 01729] ignore_null_img_alt * when ignore_null_img_alt is OFF, no img link is displayed when no ALT attribute is specified. From: Hironori Sakamoto Subject: [w3m-dev 01730] Re:
    in a table Improvement of
    . From: Hironori Sakamoto Subject: [w3m-dev 01731] completion list When completing a filename, the candidates of the completion will be displayed like this: ----- Completion list ----- X11R6/ compat/ include/ libdata/ local/ nfs/ ports/ share/ bin/ games/ lib/ libexec/ mdec/ obj/ sbin/ src/ (Load)Filename? /usr/ From: Kiyokazu SUTO Subject: [w3m-dev 01733] A patch concerning SSL The following two improvements are done about SSL: 1. a new option ``ssl_forbid_method'' is added. 2. an error message is displayed when w3m fails to establish an SSL connection. From: Kiyokazu SUTO Subject: [w3m-dev 01735] Re: A patch concerning SSL Subject: [w3m-dev 01737] Re: A patch concerning SSL 1. the data type of ssl_forbid_method is changed from P_STRING to P_SSLPATH. 2. Error message log function. From: kiwamu Subject: [w3m-dev 01739] wheel mouse patch From: Fumitoshi UKAI Subject: [w3m-dev 01742] w3mmee 0.1.11p16-6 segfault w3mmee 0.1.11p16-6 segfaults depending on the content of mime.types. From: Hironori Sakamoto Subject: [w3m-dev 01752] SEGV in search_param() > >> * w3m -o 1 causes SEGV. From: Hironori Sakamoto Subject: [w3m-dev 01753] empty .. have no