diff options
| -rw-r--r-- | APKBUILD | 4 | ||||
| -rw-r--r-- | CONTRIBUTING.md | 20 | ||||
| -rw-r--r-- | PKGBUILD | 4 | ||||
| -rw-r--r-- | debian/control | 6 | ||||
| -rw-r--r-- | debian/copyright | 4 | ||||
| -rw-r--r-- | debian/watch | 2 | ||||
| -rw-r--r-- | doc/source/config.rst | 8 | ||||
| -rw-r--r-- | doc/source/debug.rst | 4 | ||||
| -rw-r--r-- | doc/source/download.rst | 8 | ||||
| -rw-r--r-- | doc/source/faq.rst | 53 | ||||
| -rw-r--r-- | doc/source/installation.rst | 4 | ||||
| -rw-r--r-- | src/php_snuffleupagus.h | 2 | ||||
| -rw-r--r-- | src/sp_config_keywords.c | 2 | ||||
| -rw-r--r-- | src/sp_disabled_functions.c | 2 | ||||
| -rw-r--r-- | src/sp_upload_validation.c | 2 | ||||
| -rw-r--r-- | src/tests/disable_function/disabled_functions_drop_include.phpt | 2 | ||||
| -rw-r--r-- | src/tests/disable_function/disabled_functions_drop_include_simulation.phpt | 2 | ||||
| -rw-r--r-- | src/tests/disable_function/disabled_functions_variadic.phpt | 2 |
18 files changed, 48 insertions, 83 deletions
| @@ -1,4 +1,4 @@ | |||
| 1 | # Maintainer: <secu@nbs-system.com> | 1 | # Maintained by Julien (jvoisin) Voisin <julien.voisin+snuffleupagus@dustri.org> |
| 2 | pkgname="php7-snuffleupagus" | 2 | pkgname="php7-snuffleupagus" |
| 3 | _pkgname="snuffleupagus" | 3 | _pkgname="snuffleupagus" |
| 4 | pkgver=0.1 | 4 | pkgver=0.1 |
| @@ -10,7 +10,7 @@ license="LGPL3" | |||
| 10 | depends="php7-dev php7-fpm" | 10 | depends="php7-dev php7-fpm" |
| 11 | source="" | 11 | source="" |
| 12 | 12 | ||
| 13 | _giturl="https://github.com/nbs-system/snuffleupagus.git" | 13 | _giturl="https://github.com/jvoisin/snuffleupagus.git" |
| 14 | 14 | ||
| 15 | prepare() { | 15 | prepare() { |
| 16 | default_prepare | 16 | default_prepare |
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 88a3297..40ad357 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md | |||
| @@ -6,9 +6,9 @@ First off, thank you for considering contributing to snuffleupagus. | |||
| 6 | 6 | ||
| 7 | If you've noticed a bug or have a question, | 7 | If you've noticed a bug or have a question, |
| 8 | look at the [faq](https://snuffleupagus.readthedocs.io/faq.html) and | 8 | look at the [faq](https://snuffleupagus.readthedocs.io/faq.html) and |
| 9 | [search the issue tracker](https://github.com/nbs-system/snuffleupagus/issues) | 9 | [search the issue tracker](https://github.com/jvoisin/snuffleupagus/issues) |
| 10 | to see if someone else has already created a ticket. If not, go ahead and | 10 | to see if someone else has already created a ticket. If not, go ahead and |
| 11 | [make one](https://github.com/nbs-system/snuffleupagus/issues/new)! | 11 | [make one](https://github.com/jvoisin/snuffleupagus/issues/new)! |
| 12 | 12 | ||
| 13 | ### 2. Fork & create a branch | 13 | ### 2. Fork & create a branch |
| 14 | 14 | ||
| @@ -28,7 +28,7 @@ Just type `make coverage` or `make debug`, the testsuite should be run | |||
| 28 | automatically. | 28 | automatically. |
| 29 | 29 | ||
| 30 | Please add tests if you're fixing a bug or adding a new feature: we do have a | 30 | Please add tests if you're fixing a bug or adding a new feature: we do have a |
| 31 | [high coverage](https://coveralls.io/github/nbs-system/snuffleupagus?branch=master) | 31 | [high coverage](https://coveralls.io/github/jvoisin/snuffleupagus?branch=master) |
| 32 | (functions, lines and branches), and intend to keep it that way. | 32 | (functions, lines and branches), and intend to keep it that way. |
| 33 | 33 | ||
| 34 | #### 3.3 Debugging failures in the test suite | 34 | #### 3.3 Debugging failures in the test suite |
| @@ -45,9 +45,9 @@ launching it, in order to run the failing test inside GDB. | |||
| 45 | ### 4. Did you find a bug? | 45 | ### 4. Did you find a bug? |
| 46 | 46 | ||
| 47 | * **Ensure the bug was not already reported** by | 47 | * **Ensure the bug was not already reported** by |
| 48 | [searching all issues](https://github.com/nbs-system/snuffleupagus/issues?q=). | 48 | [searching all issues](https://github.com/jvoisin/snuffleupagus/issues?q=). |
| 49 | * If you're unable to find an open issue addressing the problem, | 49 | * If you're unable to find an open issue addressing the problem, |
| 50 | [open a new one](https://github.com/nbs-system/snuffleupagus/issues/new). | 50 | [open a new one](https://github.com/jvoisin/snuffleupagus/issues/new). |
| 51 | Be sure to include a **title and clear description**, | 51 | Be sure to include a **title and clear description**, |
| 52 | as much relevant information as possible, and a **code sample** | 52 | as much relevant information as possible, and a **code sample** |
| 53 | or an **executable test case** demonstrating the expected behavior that is not | 53 | or an **executable test case** demonstrating the expected behavior that is not |
| @@ -67,7 +67,7 @@ At this point, you should switch back to your master branch and make sure it's | |||
| 67 | up to date with our upstream master branch: | 67 | up to date with our upstream master branch: |
| 68 | 68 | ||
| 69 | ```sh | 69 | ```sh |
| 70 | git remote add upstream git@github.com:nbs-system/snuffleupagus.git | 70 | git remote add upstream git@github.com:jvoisin/snuffleupagus.git |
| 71 | git checkout master | 71 | git checkout master |
| 72 | git pull upstream master | 72 | git pull upstream master |
| 73 | ``` | 73 | ``` |
| @@ -82,7 +82,7 @@ git push --set-upstream origin 325-kill-sql-injections | |||
| 82 | 82 | ||
| 83 | Finally, go to GitHub and [make a Pull Request](https://help.github.com/articles/creating-a-pull-request) :D | 83 | Finally, go to GitHub and [make a Pull Request](https://help.github.com/articles/creating-a-pull-request) :D |
| 84 | 84 | ||
| 85 | Travis CI will [run our test suite](https://travis-ci.org/nbs-system/snuffleupagus) | 85 | Travis CI will [run our test suite](https://travis-ci.org/jvoisin/snuffleupagus) |
| 86 | against all supported PHP versions. We care about quality, so your PR won't be | 86 | against all supported PHP versions. We care about quality, so your PR won't be |
| 87 | merged until all tests pass. It's unlikely, but it's possible that your changes | 87 | merged until all tests pass. It's unlikely, but it's possible that your changes |
| 88 | pass tests in one PHP version but fail in another. In that case, you'll have to | 88 | pass tests in one PHP version but fail in another. In that case, you'll have to |
| @@ -121,7 +121,7 @@ Maintainers need to do the following to push out a release: | |||
| 121 | 121 | ||
| 122 | 1. Make sure that all pending and mergeable pull requests are in | 122 | 1. Make sure that all pending and mergeable pull requests are in |
| 123 | 2. Close the corresponding | 123 | 2. Close the corresponding |
| 124 | [milestone](https://github.com/nbs-system/snuffleupagus/milestones) | 124 | [milestone](https://github.com/jvoisin/snuffleupagus/milestones) |
| 125 | 2. Run `valgrind` (by adding a `-m` after the `-q` in the Makefile) and check that everything is ok. | 125 | 2. Run `valgrind` (by adding a `-m` after the `-q` in the Makefile) and check that everything is ok. |
| 126 | Don't mind the python-related issues. | 126 | Don't mind the python-related issues. |
| 127 | 3. Update the `src/php_snuffleupagus.h` according to [semantic versioning](https://semver.org/) | 127 | 3. Update the `src/php_snuffleupagus.h` according to [semantic versioning](https://semver.org/) |
| @@ -132,15 +132,13 @@ Maintainers need to do the following to push out a release: | |||
| 132 | 8. Create a tag for the release: | 132 | 8. Create a tag for the release: |
| 133 | 133 | ||
| 134 | ```sh | 134 | ```sh |
| 135 | git config user.signingkey 498C46FF087EDC36E7EAF9D445414A82A9B22D78 | ||
| 136 | git config user.email security@nbs-system.com | ||
| 137 | git tag -s v$MAJOR.$MINOR.$PATCH -m "v$MAJOR.$MINOR.$PATCH" | 135 | git tag -s v$MAJOR.$MINOR.$PATCH -m "v$MAJOR.$MINOR.$PATCH" |
| 138 | git push --tags | 136 | git push --tags |
| 139 | git push origin master | 137 | git push origin master |
| 140 | ``` | 138 | ``` |
| 141 | 139 | ||
| 142 | 9. Build the debian package with `make debian` | 140 | 9. Build the debian package with `make debian` |
| 143 | 10. Create the [release on github](https://github.com/nbs-system/snuffleupagus/releases) | 141 | 10. Create the [release on github](https://github.com/jvoisin/snuffleupagus/releases) |
| 144 | 11. Add the freshly built Debian package to the release | 142 | 11. Add the freshly built Debian package to the release |
| 145 | 12. Publish a [tweet](https://twitter.com/sp_php) | 143 | 12. Publish a [tweet](https://twitter.com/sp_php) |
| 146 | 13. Do the *secret release dance* | 144 | 13. Do the *secret release dance* |
| @@ -1,4 +1,4 @@ | |||
| 1 | # Maintainer NBS System Security Team <secu@nbs-system.com> | 1 | # Maintained by Julien (jvoisin) Voisin <julien.voisin+snuffleupagus@dustri.org> |
| 2 | pkgname="snuffleupagus" | 2 | pkgname="snuffleupagus" |
| 3 | pkgver=r169.424845a | 3 | pkgver=r169.424845a |
| 4 | pkgrel=1 | 4 | pkgrel=1 |
| @@ -8,7 +8,7 @@ arch=('i686' 'x86_64') | |||
| 8 | license=('LGPL3') | 8 | license=('LGPL3') |
| 9 | depends=('php' 'php-fpm') | 9 | depends=('php' 'php-fpm') |
| 10 | checkdepends=() | 10 | checkdepends=() |
| 11 | source=("${pkgname}::git+https://github.com/nbs-system/${pkgname}.git") | 11 | source=("${pkgname}::git+https://github.com/jvoisin/${pkgname}.git") |
| 12 | md5sums=('SKIP') | 12 | md5sums=('SKIP') |
| 13 | 13 | ||
| 14 | pkgver() { | 14 | pkgver() { |
diff --git a/debian/control b/debian/control index 5ec0480..bd9c361 100644 --- a/debian/control +++ b/debian/control | |||
| @@ -1,11 +1,11 @@ | |||
| 1 | Source: snuffleupagus | 1 | Source: snuffleupagus |
| 2 | Priority: optional | 2 | Priority: optional |
| 3 | Maintainer: NBS System <snuffleupagus@nbs-system.com> | 3 | Maintainer: Julien (jvoisin) Voisin <julien.voisin+snuffleupagus@dustri.org> |
| 4 | Build-Depends: debhelper (>= 9), php7.0-dev | php7.1-dev | php7.2-dev | 4 | Build-Depends: debhelper (>= 9), php7.0-dev | php7.1-dev | php7.2-dev |
| 5 | Standards-Version: 4.1.3 | 5 | Standards-Version: 4.1.3 |
| 6 | Homepage: https://snuffleupagus.fr | 6 | Homepage: https://github.com/jvoisin/snuffleupagus |
| 7 | Section: php | 7 | Section: php |
| 8 | Vcs-Git: https://github.com/nbs-system/snuffleupagus | 8 | Vcs-Git: https://github.com/jvoisin/snuffleupagus |
| 9 | 9 | ||
| 10 | Package: snuffleupagus | 10 | Package: snuffleupagus |
| 11 | Architecture: any | 11 | Architecture: any |
diff --git a/debian/copyright b/debian/copyright index a792452..af8f542 100644 --- a/debian/copyright +++ b/debian/copyright | |||
| @@ -1,7 +1,7 @@ | |||
| 1 | Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ | 1 | Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ |
| 2 | Upstream-Name: Snuffleupagus | 2 | Upstream-Name: Snuffleupagus |
| 3 | Upstream-Contact: NBS System <snuffleupagus@nbs-system.com> | 3 | Upstream-Contact: Julien (jvoisin) Voisin <julien.voisin+snuffleupagus@dustri.org> |
| 4 | Source: https://github.com/nbs-system/snuffleupagus | 4 | Source: https://github.com/jvoisin/snuffleupagus |
| 5 | 5 | ||
| 6 | Files: * | 6 | Files: * |
| 7 | Copyright: 2017 NBS System | 7 | Copyright: 2017 NBS System |
diff --git a/debian/watch b/debian/watch index 86028c7..2f88601 100644 --- a/debian/watch +++ b/debian/watch | |||
| @@ -1,2 +1,2 @@ | |||
| 1 | version=3 | 1 | version=3 |
| 2 | https://github.com/nbs-system/snuffleupagus/tags /nbs-system/snuffleupagus/archive/snuffleupagus-([0-9.]+)\.tar\.(gz|xz|bz2) | 2 | https://github.com/jvoisin/snuffleupagus/tags /jvoisin/snuffleupagus/archive/snuffleupagus-([0-9.]+)\.tar\.(gz|xz|bz2) |
diff --git a/doc/source/config.rst b/doc/source/config.rst index 4be8db7..7691f89 100644 --- a/doc/source/config.rst +++ b/doc/source/config.rst | |||
| @@ -199,8 +199,8 @@ argument and various information about it in the environment: | |||
| 199 | 199 | ||
| 200 | This feature can be used, for example, to check if an uploaded file contains php | 200 | This feature can be used, for example, to check if an uploaded file contains php |
| 201 | code, using `vld <https://derickrethans.nl/projects.html#vld>`_, | 201 | code, using `vld <https://derickrethans.nl/projects.html#vld>`_, |
| 202 | via `a python script <https://github.com/nbs-system/snuffleupagus/tree/master/scripts/upload_validation.py>`__, | 202 | via `a python script <https://github.com/jvoisin/snuffleupagus/tree/master/scripts/upload_validation.py>`__, |
| 203 | or `a php one <https://github.com/nbs-system/snuffleupagus/tree/master/scripts/upload_validation.php>`__. | 203 | or `a php one <https://github.com/jvoisin/snuffleupagus/tree/master/scripts/upload_validation.php>`__. |
| 204 | 204 | ||
| 205 | The upload will be **allowed** if the script returns the value ``0``. Every other | 205 | The upload will be **allowed** if the script returns the value ``0``. Every other |
| 206 | value will prevent the file from being uploaded. | 206 | value will prevent the file from being uploaded. |
| @@ -342,7 +342,7 @@ For clarity, the presence of the ``allow`` or ``drop`` action is **mandatory**. | |||
| 342 | because it'll match the deny first. | 342 | because it'll match the deny first. |
| 343 | 343 | ||
| 344 | If you're paranoid, we're providing a `php script | 344 | If you're paranoid, we're providing a `php script |
| 345 | <https://github.com/nbs-system/snuffleupagus/blob/master/scripts/generate_rules.php>`__ | 345 | <https://github.com/jvoisin/snuffleupagus/blob/master/scripts/generate_rules.php>`__ |
| 346 | to automatically generate hash of files containing dangerous functions, and | 346 | to automatically generate hash of files containing dangerous functions, and |
| 347 | blacklisting them everywhere else. | 347 | blacklisting them everywhere else. |
| 348 | 348 | ||
| @@ -358,7 +358,7 @@ It's currently not possible to: | |||
| 358 | things like this, odds are that you're doing something wrong anyway. | 358 | things like this, odds are that you're doing something wrong anyway. |
| 359 | - Hooks on ``echo`` and on ``print`` are equivalent: there is no way to hook one | 359 | - Hooks on ``echo`` and on ``print`` are equivalent: there is no way to hook one |
| 360 | without hooking the other, at least | 360 | without hooking the other, at least |
| 361 | `for now <https://github.com/nbs-system/snuffleupagus/issues/190>`__). | 361 | `for now <https://github.com/jvoisin/snuffleupagus/issues/190>`__). |
| 362 | This is why hooked ``print`` will be displayed as ``echo`` in the logs. | 362 | This is why hooked ``print`` will be displayed as ``echo`` in the logs. |
| 363 | - Hook `strlen`, since in latest PHP versions, this function is usually | 363 | - Hook `strlen`, since in latest PHP versions, this function is usually |
| 364 | optimized away by the compiled. | 364 | optimized away by the compiled. |
diff --git a/doc/source/debug.rst b/doc/source/debug.rst index b339366..b2a1f28 100644 --- a/doc/source/debug.rst +++ b/doc/source/debug.rst | |||
| @@ -18,7 +18,7 @@ We're using `php qa <https://qa.php.net/>`__ tests format for our testsuite, | |||
| 18 | it is automatically run when you're building snuffleupagus. | 18 | it is automatically run when you're building snuffleupagus. |
| 19 | 19 | ||
| 20 | If it happens to have unexpected failures (Since we're using `TDD <https://en.wikipedia.org/wiki/Test-driven_development>`__ as much | 20 | If it happens to have unexpected failures (Since we're using `TDD <https://en.wikipedia.org/wiki/Test-driven_development>`__ as much |
| 21 | as we can, we do have some expected failures), please do `open an issue <https://github.com/nbs-system/snuffleupagus/issues/new>`__ | 21 | as we can, we do have some expected failures), please do `open an issue <https://github.com/jvoisin/snuffleupagus/issues/new>`__ |
| 22 | on our bugtracker, and attach the generated ``.diff`` and ``.out`` files to it, | 22 | on our bugtracker, and attach the generated ``.diff`` and ``.out`` files to it, |
| 23 | so we can see what's happening. | 23 | so we can see what's happening. |
| 24 | 24 | ||
| @@ -27,7 +27,7 @@ Snuffleupagus is crashing | |||
| 27 | 27 | ||
| 28 | While we do our very best to make snuffleupagus solid as possible, we're humans, | 28 | While we do our very best to make snuffleupagus solid as possible, we're humans, |
| 29 | and computers are hard, so crashes can happen. If you're encountering one in production, | 29 | and computers are hard, so crashes can happen. If you're encountering one in production, |
| 30 | please try to launch the `testsuite <https://github.com/nbs-system/snuffleupagus/blob/master/CONTRIBUTING.md#3-get-the-test-suite-running>`__ | 30 | please try to launch the `testsuite <https://github.com/jvoisin/snuffleupagus/blob/master/CONTRIBUTING.md#3-get-the-test-suite-running>`__ |
| 31 | to see if it's failing. If it does, please :ref:`tell us <testsuite_fail>`. | 31 | to see if it's failing. If it does, please :ref:`tell us <testsuite_fail>`. |
| 32 | 32 | ||
| 33 | If the testsuite is passing, odds are that you're encountering an issue tied to your php code, | 33 | If the testsuite is passing, odds are that you're encountering an issue tied to your php code, |
diff --git a/doc/source/download.rst b/doc/source/download.rst index dfe4768..fd61099 100644 --- a/doc/source/download.rst +++ b/doc/source/download.rst | |||
| @@ -4,20 +4,20 @@ Download | |||
| 4 | Arch Linux | 4 | Arch Linux |
| 5 | ---------- | 5 | ---------- |
| 6 | 6 | ||
| 7 | We're providing a `PKGBUILD <https://github.com/nbs-system/snuffleupagus/blob/master/PKGBUILD>`__, | 7 | We're providing a `PKGBUILD <https://github.com/jvoisin/snuffleupagus/blob/master/PKGBUILD>`__, |
| 8 | so you can build a package yourself. | 8 | so you can build a package yourself. |
| 9 | 9 | ||
| 10 | Alpine Linux | 10 | Alpine Linux |
| 11 | ------------ | 11 | ------------ |
| 12 | 12 | ||
| 13 | We're providing a `APKBUILD <https://github.com/nbs-system/snuffleupagus/blob/master/APKBUILD>`__, | 13 | We're providing a `APKBUILD <https://github.com/jvoisin/snuffleupagus/blob/master/APKBUILD>`__, |
| 14 | so you can build a package yourself. | 14 | so you can build a package yourself. |
| 15 | 15 | ||
| 16 | Debian and Ubuntu | 16 | Debian and Ubuntu |
| 17 | ----------------- | 17 | ----------------- |
| 18 | 18 | ||
| 19 | We're currently not providing a Debian/Ubuntu repository, | 19 | We're currently not providing a Debian/Ubuntu repository, |
| 20 | but you can grab the latest release on `github <https://github.com/nbs-system/snuffleupagus/releases>`__, | 20 | but you can grab the latest release on `github <https://github.com/jvoisin/snuffleupagus/releases>`__, |
| 21 | or build your own package by cloning the source code and typing ``make debian``. | 21 | or build your own package by cloning the source code and typing ``make debian``. |
| 22 | 22 | ||
| 23 | Fedora | 23 | Fedora |
| @@ -39,4 +39,4 @@ We're currently using *github* as public code repository. | |||
| 39 | 39 | ||
| 40 | :: | 40 | :: |
| 41 | 41 | ||
| 42 | git clone https://github.com/nbs-system/snuffleupagus | 42 | git clone https://github.com/jvoisin/snuffleupagus |
diff --git a/doc/source/faq.rst b/doc/source/faq.rst index 4974c70..285f0c8 100644 --- a/doc/source/faq.rst +++ b/doc/source/faq.rst | |||
| @@ -46,6 +46,8 @@ with a strong focus on security. We do have several layers of hardening | |||
| 46 | `IDS <https://en.wikipedia.org/wiki/Intrusion_detection_system>`_, etc), | 46 | `IDS <https://en.wikipedia.org/wiki/Intrusion_detection_system>`_, etc), |
| 47 | but we had nothing for PHP7. | 47 | but we had nothing for PHP7. |
| 48 | 48 | ||
| 49 | Nowadays, Snuffleupagus is maintained by Julien (jvoisin) Voisin. | ||
| 50 | |||
| 49 | 51 | ||
| 50 | Why not Suhosin? | 52 | Why not Suhosin? |
| 51 | """""""""""""""" | 53 | """""""""""""""" |
| @@ -70,7 +72,8 @@ What license is Snuffleupagus released under and why? | |||
| 70 | """"""""""""""""""""""""""""""""""""""""""""""""""""" | 72 | """"""""""""""""""""""""""""""""""""""""""""""""""""" |
| 71 | 73 | ||
| 72 | Snuffleupagus is licensed under the `LGPL <https://www.gnu.org/copyleft/lesser.html>`_ | 74 | Snuffleupagus is licensed under the `LGPL <https://www.gnu.org/copyleft/lesser.html>`_ |
| 73 | and is developed by the fine people from `NBS System <https://nbs-system.com/>`__. | 75 | was developed by the fine people from `NBS System <https://nbs-system.com/>`__, |
| 76 | and is maintained by Julien (jvoisin) Voisin. | ||
| 74 | 77 | ||
| 75 | We chose the LGPL because we don't care that much how you're using Snuffleupagus, | 78 | We chose the LGPL because we don't care that much how you're using Snuffleupagus, |
| 76 | but we'd like to force people to make their improvements/contributions | 79 | but we'd like to force people to make their improvements/contributions |
| @@ -171,7 +174,7 @@ By checking the logs; Snuffleupagus systematically prefix them with ``[snuffleup | |||
| 171 | 174 | ||
| 172 | Does Snuffleupagus run on Windows? | 175 | Does Snuffleupagus run on Windows? |
| 173 | """""""""""""""""""""""""""""""""" | 176 | """""""""""""""""""""""""""""""""" |
| 174 | No idea, feel free to `try <https://github.com/nbs-system/snuffleupagus/issues/2>`_. | 177 | No idea, feel free to `try <https://github.com/jvoisin/snuffleupagus/issues/2>`_. |
| 175 | 178 | ||
| 176 | 179 | ||
| 177 | Does Snuggleupagus run on `HHVM <http://hhvm.com/>`_? | 180 | Does Snuggleupagus run on `HHVM <http://hhvm.com/>`_? |
| @@ -204,46 +207,13 @@ discuss potential impact of the vulnerability, | |||
| 204 | reference applicable patches or workarounds, | 207 | reference applicable patches or workarounds, |
| 205 | and credit the discoverer. | 208 | and credit the discoverer. |
| 206 | 209 | ||
| 207 | Please send it us a mail to the ``security`` user, | 210 | Please do send a mail to [Julien (jvoisin) Voisin](https://dustri.org) should |
| 208 | on ``nbs-system.com``, using the gpg key | 211 | you find a security issue. |
| 209 | ``498C46FF087EDC36E7EAF9D445414A82A9B22D78``: | ||
| 210 | |||
| 211 | :: | ||
| 212 | |||
| 213 | -----BEGIN PGP PUBLIC KEY BLOCK----- | ||
| 214 | 212 | ||
| 215 | mQENBFnKHhoBCADaOa0MKEqRy0h2ohIzczblzkMQCbU9oD1HwJ1VkYnn7TGW2iKi | ||
| 216 | NISxisExIXpy2Bn/pA27GiV0V/Do3NL6D9r0oOCrGR27muGM0N/dk9UMv7MWw8zv | ||
| 217 | K8cO+Sa28s0cAv7r2ogUJj5YOo8D4wHEpE8424TE89V9+Qg/SaFCxKoELFP0c7wu | ||
| 218 | mtsm0PnL65piZ1EB7lQo2gxg+8AV45MD1Y2rREMKUoZE23X+nXKsmEh9BFEPaU5M | ||
| 219 | 7WQp0NasqeMNoGhwfw9ttVAeLhkEkaTjW1PkNRIb7vrtV9KVb5uKucflfbOnDlzu | ||
| 220 | tQ9U3tYto0mcSCRchAClfEmoSi/0mKyb5N6ZABEBAAG0NVNlY3VyaXR5IHRlYW0g | ||
| 221 | b2YgTkJTIFN5c3RlbSA8c2VjdXJpdHlAbmJzLXN5c3RlbS5jb20+iQE3BBMBCAAh | ||
| 222 | BQJZyh4aAhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEEVBSoKpsi14jy0H | ||
| 223 | /1/XB9THhvmG0ow81sld2Zx8qhnNed8VvYDS6mEjpDWNVPxENwDbnakEjisq1Hrb | ||
| 224 | 2UQPYCyQ5dekPNFVwQHIGXkX0eb1Ank+4esBJuEpQ2985tgNhJy5ZX+Imb5C8nZC | ||
| 225 | 90uYSN1UUg559nUsFeElOXSEH6tIXK/TvjsvMYoi2Ukl6lb7PbIU2fjLY9Iqv3QY | ||
| 226 | 32p8/Bl1fVKWbXOk0HDgJ6zA3Kr56QhZOLBkxjOa2XAnnIE76jZxUJ9qPCwWd1vW | ||
| 227 | GFxtx1Y+eZriqHiC9CPe6aBWcIHaTXSu1WBbXrFu8/eCWw243Rxm8l9wgA/a7VWq | ||
| 228 | WBfO45IhJUwh95naRpw8/4a5AQ0EWcoeGgEIAJtzSyyzfn2RX+BsyoRFANUpIgrV | ||
| 229 | /9eohYQVNqK3AFthmq7Kjmt4+hszF5+0wCFmWwYqGnqk1/dsWmqpkXsJldEn6oPJ | ||
| 230 | Bng+Dc67Yki2dR3TroAf95UmI08fhyM7TMXp8m46BPRRMzPNwalEeEm49Oclmfxb | ||
| 231 | JsWWCChWVLWGz2xgPEAv3fPHqus7Rwz/WIl53l/qy1Wf0ewmjRpVEfnEMKBExtBK | ||
| 232 | 4kRxQ40LzUZ1SfpyGc3nMbswhevT7/klqrdJdCnlu67Y/IfRGxGZuNj1n1Dib3Hx | ||
| 233 | zTBHo3Y2R3BB93Ix8dkbLaxLqFbOYVdijCgJklqUWhx7btpQ2xnZyzyCMuUAEQEA | ||
| 234 | AYkBHwQYAQgACQUCWcoeGgIbDAAKCRBFQUqCqbIteFRvB/9u3Mae8n8ELrJKOn+P | ||
| 235 | PEbWjutObIuTplvY4QcbnNb9dsgsKryamp4CFJsA5XuitPpC31GDMXBZO5/LLOuH | ||
| 236 | HoMaXFJdic0NToL/3REhu+aZkNIU6S/iaPRNVhkSV4lwQsvncz+nBaiDUJjyfJm2 | ||
| 237 | kEjVcRTM8yqzcNo/9Gn0ts+XCUqRj7+S1M4Bj3NySoO/w2n+7OLbIAj+wQZcj3Gf | ||
| 238 | 5QhBYaY4YaFxrJE0IZxyXGHw8xhKR6AN+u4TO7LRCW+cWV/sHWir1MXieJoEG8+R | ||
| 239 | W/BhrB0Rz5uxOXMoGCCD2TUiHq7zpuHGnYFVmAnHQZaaQxXve4VrcmznxgpV8lpW | ||
| 240 | mZug | ||
| 241 | =+eIv | ||
| 242 | -----END PGP PUBLIC KEY BLOCK----- | ||
| 243 | 213 | ||
| 244 | I found a bug. How can I report it? | 214 | I found a bug. How can I report it? |
| 245 | """"""""""""""""""""""""""""""""""" | 215 | """"""""""""""""""""""""""""""""""" |
| 246 | We do have an issue tracker on `Github <https://github.com/nbs-system/snuffleupagus/issues>`_. | 216 | We do have an issue tracker on `Github <https://github.com/jvoisin/snuffleupagus/issues>`_. |
| 247 | Please make sure to include as much information as possible when reporting your issue, | 217 | Please make sure to include as much information as possible when reporting your issue, |
| 248 | such as your operating system, your version of PHP 7, your version of Snuffleupagus, | 218 | such as your operating system, your version of PHP 7, your version of Snuffleupagus, |
| 249 | your logs, the problematic php code, the request, a brief description, … long story short, | 219 | your logs, the problematic php code, the request, a brief description, … long story short, |
| @@ -255,12 +225,9 @@ it's not that hard. | |||
| 255 | Where can I find even more help? | 225 | Where can I find even more help? |
| 256 | """""""""""""""""""""""""""""""" | 226 | """""""""""""""""""""""""""""""" |
| 257 | The :doc:`configuration page <config>` might be what you're looking for. | 227 | The :doc:`configuration page <config>` might be what you're looking for. |
| 258 | If you're adventurous, you can also check the `issue tracker <https://github.com/nbs-system/snuffleupagus/issues/?q=is%3Aissue>`_ | 228 | If you're adventurous, you can also check the `issue tracker <https://github.com/jvoisin/snuffleupagus/issues/?q=is%3Aissue>`_ |
| 259 | (make sure to check the `closed issues <https://github.com/nbs-system/snuffleupagus/issues?q=is%3Aissue+is%3Aclosed>`_ too). | 229 | (make sure to check the `closed issues <https://github.com/jvoisin/snuffleupagus/issues?q=is%3Aissue+is%3Aclosed>`_ too). |
| 260 | 230 | ||
| 261 | I need professional support for my company. | ||
| 262 | """"""""""""""""""""""""""""""""""""""""""" | ||
| 263 | Contact `NBS System <https://nbs-system.com>`_. | ||
| 264 | 231 | ||
| 265 | Unimplemented mitigations and abandoned ideas | 232 | Unimplemented mitigations and abandoned ideas |
| 266 | --------------------------------------------- | 233 | --------------------------------------------- |
diff --git a/doc/source/installation.rst b/doc/source/installation.rst index 74d5d4f..a6b0ff8 100644 --- a/doc/source/installation.rst +++ b/doc/source/installation.rst | |||
| @@ -1,7 +1,7 @@ | |||
| 1 | Installation | 1 | Installation |
| 2 | ============ | 2 | ============ |
| 3 | 3 | ||
| 4 | Snuffleupagus is tested against `various PHP 7+ versions <https://travis-ci.org/nbs-system/snuffleupagus/>`_. | 4 | Snuffleupagus is tested against `various PHP 7+ versions <https://travis-ci.org/jvoisin/snuffleupagus/>`_. |
| 5 | 5 | ||
| 6 | Manual installation | 6 | Manual installation |
| 7 | ------------------- | 7 | ------------------- |
| @@ -21,7 +21,7 @@ Quickstart | |||
| 21 | 21 | ||
| 22 | :: | 22 | :: |
| 23 | 23 | ||
| 24 | git clone https://github.com/nbs-system/snuffleupagus | 24 | git clone https://github.com/jvoisin/snuffleupagus |
| 25 | cd snuffleupagus/src | 25 | cd snuffleupagus/src |
| 26 | phpize | 26 | phpize |
| 27 | ./configure --enable-snuffleupagus | 27 | ./configure --enable-snuffleupagus |
diff --git a/src/php_snuffleupagus.h b/src/php_snuffleupagus.h index 0141a87..5a02e93 100644 --- a/src/php_snuffleupagus.h +++ b/src/php_snuffleupagus.h | |||
| @@ -4,7 +4,7 @@ | |||
| 4 | #define PHP_SNUFFLEUPAGUS_VERSION "0.5.0" | 4 | #define PHP_SNUFFLEUPAGUS_VERSION "0.5.0" |
| 5 | #define PHP_SNUFFLEUPAGUS_EXTNAME "snuffleupagus" | 5 | #define PHP_SNUFFLEUPAGUS_EXTNAME "snuffleupagus" |
| 6 | #define PHP_SNUFFLEUPAGUS_AUTHOR "NBS System" | 6 | #define PHP_SNUFFLEUPAGUS_AUTHOR "NBS System" |
| 7 | #define PHP_SNUFFLEUPAGUS_URL "https://github.com/nbs-system/snuffleupagus" | 7 | #define PHP_SNUFFLEUPAGUS_URL "https://github.com/jvoisin/snuffleupagus" |
| 8 | #define PHP_SNUFFLEUPAGUS_COPYRIGHT "LGPLv2" | 8 | #define PHP_SNUFFLEUPAGUS_COPYRIGHT "LGPLv2" |
| 9 | 9 | ||
| 10 | #include <errno.h> | 10 | #include <errno.h> |
diff --git a/src/sp_config_keywords.c b/src/sp_config_keywords.c index aebe45c..c3a9c19 100644 --- a/src/sp_config_keywords.c +++ b/src/sp_config_keywords.c | |||
| @@ -44,7 +44,7 @@ int parse_session(char *line) { | |||
| 44 | "You're trying to use the session cookie encryption feature " | 44 | "You're trying to use the session cookie encryption feature " |
| 45 | "on line %zu without having session support statically built into PHP. " | 45 | "on line %zu without having session support statically built into PHP. " |
| 46 | "This isn't supported, see " | 46 | "This isn't supported, see " |
| 47 | "https://github.com/nbs-system/snuffleupagus/issues/278 for details.", | 47 | "https://github.com/jvoisin/snuffleupagus/issues/278 for details.", |
| 48 | sp_line_no); | 48 | sp_line_no); |
| 49 | pefree(session, 0); | 49 | pefree(session, 0); |
| 50 | return -1; | 50 | return -1; |
diff --git a/src/sp_disabled_functions.c b/src/sp_disabled_functions.c index 9e64993..4807955 100644 --- a/src/sp_disabled_functions.c +++ b/src/sp_disabled_functions.c | |||
| @@ -361,7 +361,7 @@ static void should_disable(zend_execute_data* execute_data, | |||
| 361 | sp_log_warn( | 361 | sp_log_warn( |
| 362 | "disable_function", | 362 | "disable_function", |
| 363 | "Snuffleupagus doesn't support variadic functions yet, sorry. " | 363 | "Snuffleupagus doesn't support variadic functions yet, sorry. " |
| 364 | "Check https://github.com/nbs-system/snuffleupagus/issues/164 for " | 364 | "Check https://github.com/jvoisin/snuffleupagus/issues/164 for " |
| 365 | "details."); | 365 | "details."); |
| 366 | } else if (false == is_param_matching( | 366 | } else if (false == is_param_matching( |
| 367 | execute_data, config_node, builtin_param, | 367 | execute_data, config_node, builtin_param, |
diff --git a/src/sp_upload_validation.c b/src/sp_upload_validation.c index ee19df9..54b0481 100644 --- a/src/sp_upload_validation.c +++ b/src/sp_upload_validation.c | |||
| @@ -15,7 +15,7 @@ int sp_rfc1867_callback_win(unsigned int event, void *event_data, | |||
| 15 | void **extra) { | 15 | void **extra) { |
| 16 | sp_log_msg("upload_validation", SP_LOG_SIMULATION, | 16 | sp_log_msg("upload_validation", SP_LOG_SIMULATION, |
| 17 | "The upload validation doesn't work for now on Windows yet, " | 17 | "The upload validation doesn't work for now on Windows yet, " |
| 18 | "see https://github.com/nbs-system/snuffleupagus/issues/248 for " | 18 | "see https://github.com/jvoisin/snuffleupagus/issues/248 for " |
| 19 | "details."); | 19 | "details."); |
| 20 | return SUCCESS; | 20 | return SUCCESS; |
| 21 | } | 21 | } |
diff --git a/src/tests/disable_function/disabled_functions_drop_include.phpt b/src/tests/disable_function/disabled_functions_drop_include.phpt index e18dd73..ba1c955 100644 --- a/src/tests/disable_function/disabled_functions_drop_include.phpt +++ b/src/tests/disable_function/disabled_functions_drop_include.phpt | |||
| @@ -1,5 +1,5 @@ | |||
| 1 | --TEST-- | 1 | --TEST-- |
| 2 | Disable function, bug : https://github.com/nbs-system/snuffleupagus/issues/181 | 2 | Disable function, bug : https://github.com/jvoisin/snuffleupagus/issues/181 |
| 3 | --SKIPIF-- | 3 | --SKIPIF-- |
| 4 | <?php if (!extension_loaded("snuffleupagus")) die "skip"; ?> | 4 | <?php if (!extension_loaded("snuffleupagus")) die "skip"; ?> |
| 5 | --INI-- | 5 | --INI-- |
diff --git a/src/tests/disable_function/disabled_functions_drop_include_simulation.phpt b/src/tests/disable_function/disabled_functions_drop_include_simulation.phpt index 07c3e98..1b13915 100644 --- a/src/tests/disable_function/disabled_functions_drop_include_simulation.phpt +++ b/src/tests/disable_function/disabled_functions_drop_include_simulation.phpt | |||
| @@ -1,5 +1,5 @@ | |||
| 1 | --TEST-- | 1 | --TEST-- |
| 2 | Disable function, bug : https://github.com/nbs-system/snuffleupagus/issues/181 | 2 | Disable function, bug : https://github.com/jvoisin/snuffleupagus/issues/181 |
| 3 | --SKIPIF-- | 3 | --SKIPIF-- |
| 4 | <?php if (!extension_loaded("snuffleupagus")) die "skip"; ?> | 4 | <?php if (!extension_loaded("snuffleupagus")) die "skip"; ?> |
| 5 | --INI-- | 5 | --INI-- |
diff --git a/src/tests/disable_function/disabled_functions_variadic.phpt b/src/tests/disable_function/disabled_functions_variadic.phpt index 5bace63..32b6b0e 100644 --- a/src/tests/disable_function/disabled_functions_variadic.phpt +++ b/src/tests/disable_function/disabled_functions_variadic.phpt | |||
| @@ -13,6 +13,6 @@ function foo(...$b) { | |||
| 13 | echo foo(5, 4, 3, 2, 1); | 13 | echo foo(5, 4, 3, 2, 1); |
| 14 | ?> | 14 | ?> |
| 15 | --EXPECTF-- | 15 | --EXPECTF-- |
| 16 | Warning: [snuffleupagus][0.0.0.0][disable_function] Snuffleupagus doesn't support variadic functions yet, sorry. Check https://github.com/nbs-system/snuffleupagus/issues/164 for details. in %a/disabled_functions_variadic.php on line %d | 16 | Warning: [snuffleupagus][0.0.0.0][disable_function] Snuffleupagus doesn't support variadic functions yet, sorry. Check https://github.com/jvoisin/snuffleupagus/issues/164 for details. in %a/disabled_functions_variadic.php on line %d |
| 17 | 17 | ||
| 18 | Fatal error: [snuffleupagus][0.0.0.0][disabled_function] Aborted execution on call of the function 'foo' in %a/disabled_functions_variadic.php on line %d | 18 | Fatal error: [snuffleupagus][0.0.0.0][disabled_function] Aborted execution on call of the function 'foo' in %a/disabled_functions_variadic.php on line %d |
