Linux Archive - Merge request

On Sat, Dec 17, 2011 at 4:32 PM, speps <speps@gmx.com> wrote:
> Hi,
>
> a merge is requested:
>
> [1] zope-event * * -> [2] python2-zope-event
> [3] zope-component -> [4] python2-zope-component
>
> Tnx
>
>
> [1] https://aur.archlinux.org/packages.php?ID=14382
> [2] https://aur.archlinux.org/packages.php?ID=55058
> [3] https://aur.archlinux.org/packages.php?ID=14379
> [4] https://aur.archlinux.org/packages.php?ID=55056
>
> - speps -

done

Sun Dec 18 01:30:01 2011
Return-path: <bounce-debian-devel=tom=linux-archive.org@lists.debian.org>
Envelope-to: tom@linux-archive.org
Delivery-date: Sun, 18 Dec 2011 00:40:22 +0200
Received: from liszt.debian.org ([82.195.75.100]:38898)
by s2.java-tips.org with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <bounce-debian-devel=tom=linux-archive.org@lists.debian.org>)
id 1Rc2vW-0006QO-1Q
for tom@linux-archive.org; Sun, 18 Dec 2011 00:40:22 +0200
Received: from localhost (localhost [127.0.0.1])
by liszt.debian.org (Postfix) with QMQP
id 899AC13A43BE; Sat, 17 Dec 2011 22:40:29 +0000 (UTC)
Old-Return-Path: <martinez.faneyth@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on liszt.debian.org
X-Spam-Level:
X-Spam-Status: No, score=-10.9 required=4.0 tests=FOURLA,GMAIL,LDOSUBSCRIBER,
LDO_WHITELIST,RCVD_IN_DNSWL_LOW autolearnúiled version=3.2.5
X-Original-To: lists-debian-devel@liszt.debian.org
Delivered-To: lists-debian-devel@liszt.debian.org
Received: from localhost (localhost [127.0.0.1])
by liszt.debian.org (Postfix) with ESMTP id D483713A4314
for <lists-debian-devel@liszt.debian.org>; Sat, 17 Dec 2011 22:40:22 +0000 (UTC)
X-Virus-Scanned: at lists.debian.org with policy bank en-ht
X-Amavis-Spam-Status: No, score=-6.9 tagged_above=-10000 required=5.3
tests=[BAYES_00=-2, FOURLA=0.1, GMAIL=1, LDO_WHITELIST=-5,
RCVD_IN_DNSWL_LOW=-1] autolearn=ham
Received: from liszt.debian.org ([127.0.0.1])
by localhost (lists.debian.org [127.0.0.1]) (amavisd-new, port 2525)
with ESMTP id I8Kh+AlcUsWS for <lists-debian-devel@liszt.debian.org>;
Sat, 17 Dec 2011 22:40:15 +0000 (UTC)
X-policyd-weight: using cached result; rate:hard: -7
Received: from mail-qw0-f47.google.com (mail-qw0-f47.google.com [209.85.216.47])
(using TLSv1 with cipher RC4-SHA (128/128 bits))
(Client CN "smtp.gmail.com", Issuer "Google Internet Authority" (not verified))
by liszt.debian.org (Postfix) with ESMTPS id 3D5C813A417E
for <debian-devel@lists.debian.org>; Sat, 17 Dec 2011 22:40:15 +0000 (UTC)
Received: by qadb17 with SMTP id b17so1750701qad.6
for <debian-devel@lists.debian.org>; Sat, 17 Dec 2011 14:39:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=message-id:date:from:reply-to:organization:user-agent:mime-version
:to:cc:subject:references:in-reply-to:x-enigmail-version
:content-type:content-transfer-encoding;
bhðqpC5ZLaHtSeIs8sdKfhO1lktXpVrHuUdB6hzaNG+c=;
b=dwZwB0uSvcgrAWaPrgiRnskeRh4qkDZy7NtbMZ8nzz2oxo46 DgeObPE97aYz0TMIqV
+qQYMpYn4CPMk05XZ8CWS8S688KEWIuRBjIXMU0idTg5UsQso0 9HFOkTkmV9A0mP4R0y
YKmz1vLzZDujNYavf5v+mSOilrHQ8kd7X30WUReceived: by 10.224.34.17 with SMTP id j17mr18677322qad.22.1324161593621;
Sat, 17 Dec 2011 14:39:53 -0800 (PST)
Received: from [10.0.0.56] ([190.204.236.73])
by mx.google.com with ESMTPS id dj9sm29004354qab.18.2011.12.17.14.39.51
(version=SSLv3 cipher=OTHER);
Sat, 17 Dec 2011 14:39:52 -0800 (PST)
Message-ID: <4EED19EB.9010604@gmail.com>
Date: Sat, 17 Dec 2011 18:08:35 -0430
From: =?UTF-8?B?THVpcyBBbGVqYW5kcm8gTWFydMOtbmV6IEZhbmV5dGg=? <martinez.faneyth@gmail.com>
Reply-To: martinez.faneyth@gmail.com
Organization: http://www.huntingbears.com.ve/
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20110805 Icedove/5.0
MIME-Version: 1.0
To: Sune Vuorela <sune@debian.org>
CC: 652464@bugs.debian.org, debian-devel@lists.debian.org
Subject: Re: Bug#652464: ITP: aguilas -- A web-based LDAP user management
system
References: <20111217134822.10890.2219.reportbug@OKComputer> <201112172149.16597.sune@debian.org>
In-Reply-To: <201112172149.16597.sune@debian.org>
X-Enigmail-Version: 1.2
Content-Type: text/plain; charset=UTF-8
X-Rc-Virus: 2007-09-13_01
X-Rc-Spam: 2008-11-04_01
Resent-Message-ID: <yl2hjKOVyfD.A.MYD.dpR7OB@liszt>
Resent-From: debian-devel@lists.debian.org
X-Mailing-List: <debian-devel@lists.debian.org> archive/latest/277969
X-Loop: debian-devel@lists.debian.org
List-Id: <debian-devel.lists.debian.org>
List-Post: <mailto:debian-devel@lists.debian.org>
List-Help: <mailto:debian-devel-request@lists.debian.org?subject=help>
List-Subscribe: <mailto:debian-devel-request@lists.debian.org?subject=subscribe>
List-Unsubscribe: <mailto:debian-devel-request@lists.debian.org?subject=unsubscribe>
Precedence: list
Resent-Sender: debian-devel-request@lists.debian.org
Resent-Date: Sat, 17 Dec 2011 22:40:29 +0000 (UTC)
Content-Transfer-Encoding: quoted-printable

On 17/12/11 16:19, Sune Vuorela wrote:
> On Saturday 17 December 2011 14:48:22 Luis Alejandro MartÃ*nez Faneyth wrote:
>> Package: wnpp
>> Severity: wishlist
>> Owner: "Luis Alejandro MartÃ*nez Faneyth" <martinez.faneyth@gmail.com>
>>
>> * Package name : aguilas
>> Version : 1.0.0
>> Upstream Author : Luis Alejandro MartÃ*nez Faneyth
>> <martinez.faneyth@gmail.com>
>> * URL : http://code.google.com/p/aguilas
>> * License : GPL-3
>> Programming Lang: PHP
>> Description : A web-based LDAP user management system
>>
>> AGUILAS is an application written mostly in PHP, but it has bits of
>> JavaScript, SQL, style sheets and of course, HTML. It is a centralized
>
> I was showing 'aguilas' to some people also looking for web based ldap user
> management systems, and then within not too much time, I got a message back
> saying
>
> "not sure I like the look of that sql query..."
> "sql injection in 5 seconds flat"
>
>
> $sel_q = "SELECT * FROM NewUser"
> . " WHERE mail='" . $mail . "'"
> . " AND uid='" . $uid . "'"
> . " AND token='" . $token . "'"
> . " ORDER BY token DESC LIMIT 0,1";

Thanks for having a look :)

Well, i perform a very strict validation before that query is made.
Lines 20 - 54:

http://code.google.com/p/aguilas/source/browse/NewUserDo.php#20
http://code.google.com/p/aguilas/source/browse/NewUserDo.php#54

You are still scared?

>
> I also got a bit scared by this.
>
> /Sune

--
Sin mÃ¡s que agregar y siempre a la orden,

Luis Alejandro MartÃ*nez Faneyth
Ingeniero de Telecomunicaciones
Blog: http://www.huntingbears.com.ve/
Twitter: @LuisAlejandro
GPG Key = E78DAA2E

CODE IS POETRY

--
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/4EED19EB.9010604@gmail.com