Attachment 59711 Details for Bug 136704

[patch] diff between Snoopy 1.2 and 1.2.1

Snoopy-1.2-1.2.1.dif (text/plain), 6.49 KB, created by Peter Poeml on 2005-12-02 16:19:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Peter Poeml

Created: 2005-12-02 16:19:51 UTC

Size: 6.49 KB

patch

obsolete

>diff -uNrw --strip-trailing-cr Snoopy-1.2/AUTHORS Snoopy-1.2.1/AUTHORS
>--- Snoopy-1.2/AUTHORS	2004-12-16 17:25:35.000000000 +0100
>+++ Snoopy-1.2.1/AUTHORS	2005-10-24 16:45:48.000000000 +0200
>@@ -8,3 +8,4 @@
> 
> Gene Wood <gene_wood@users.sourceforge.net>
>     - bug fixes
>+    - security fixes
>diff -uNrw --strip-trailing-cr Snoopy-1.2/ChangeLog Snoopy-1.2.1/ChangeLog
>--- Snoopy-1.2/ChangeLog	2004-12-16 17:25:35.000000000 +0100
>+++ Snoopy-1.2.1/ChangeLog	2005-10-24 16:39:00.000000000 +0200
>@@ -1,3 +1,11 @@
>+Version 1.2.1
>+-----------
>+    - fixed potential security issue with unchecked variables being passed to exec (for https with curl) (gene_wood)
>+    - fixed BUG # 1086830 : submitlinks,fetchlinks and submittext expandlinks with the URI of the original page not the refreshed page (gene_wood)
>+    - fixed BUG # 1077870 : Snoopy can't deal with multiple spaces in a refresh tag (gene_wood)
>+    - fixed BUG # 864047 : Root relative links are treated as relative (gene_wood)
>+    - fixed BUG # 1097134 : Undefined URI_PARTS["path"] generates Notice (gene_wood)
>+
> Version 1.2
> -----------
>     - fixed BUG # 1014823 : Meta redirect regex inaccurate (gene_wood)
>diff -uNrw --strip-trailing-cr Snoopy-1.2/FAQ Snoopy-1.2.1/FAQ
>--- Snoopy-1.2/FAQ	2000-02-03 16:40:59.000000000 +0100
>+++ Snoopy-1.2.1/FAQ	2005-10-24 16:44:47.000000000 +0200
>@@ -1,3 +1,9 @@
>+Q:	Why can't I fetch https pages?
>+A:	Using Snoopy to fetch an https page requires curl. Check if curl is installed on your host. If curl is installed, it may be located in a different place than the default. By default Snoopy looks for curl in /usr/local/bin/curl. Run 'which curl' and find out your location. If it differs from the default, then you'll need to set the $snoopy->curl_path variable to the location of your curl installation. Here's an example of the code :
>+		include "Snoopy.class.php";
>+		$snoopy = new Snoopy;
>+		$snoopy->curl_path="/usr/bin/curl";
>+
> Q:	where does the function preg_match_all come from?
> A:	PCRE functions in PHP 3.0.9 and later
> 
>diff -uNrw --strip-trailing-cr Snoopy-1.2/NEWS Snoopy-1.2.1/NEWS
>--- Snoopy-1.2/NEWS	2004-12-16 17:35:12.000000000 +0100
>+++ Snoopy-1.2.1/NEWS	2005-10-24 16:40:25.000000000 +0200
>@@ -1,5 +1,10 @@
>+RELEASE NOTE: v1.2.1
>+October 24, 2005
>+
>+Fixed a few outstanding bugs and a potential security hole.
>+
> RELEASE NOTE: v1.2
>-December 16, 2004
>+November 17, 2004
> 
> Fixed a number of outstanding bugs.
> 
>diff -uNrw --strip-trailing-cr Snoopy-1.2/README Snoopy-1.2.1/README
>--- Snoopy-1.2/README	2004-12-16 17:25:35.000000000 +0100
>+++ Snoopy-1.2.1/README	2005-10-24 16:39:50.000000000 +0200
>@@ -1,6 +1,6 @@
> NAME:
> 
>-	Snoopy - the PHP net client v1.2
>+	Snoopy - the PHP net client v1.2.1
> 	
> SYNOPSIS:
> 
>diff -uNrw --strip-trailing-cr Snoopy-1.2/Snoopy.class.php Snoopy-1.2.1/Snoopy.class.php
>--- Snoopy-1.2/Snoopy.class.php	2004-12-16 17:34:38.000000000 +0100
>+++ Snoopy-1.2.1/Snoopy.class.php	2005-10-24 16:32:33.000000000 +0200
>@@ -5,7 +5,7 @@
> Snoopy - the PHP net client
> Author: Monte Ohrt <monte@ispi.net>
> Copyright (c): 1999-2000 ispi, all rights reserved
>-Version: 1.2
>+Version: 1.01
> 
>  * This library is free software; you can redistribute it and/or
>  * modify it under the terms of the GNU Lesser General Public
>@@ -48,7 +48,7 @@
> 	var $proxy_user		=	"";					// proxy user to use
> 	var $proxy_pass		=	"";					// proxy password to use
> 	
>-	var $agent			=	"Snoopy v1.2";		// agent we masquerade as
>+	var $agent			=	"Snoopy v1.01";		// agent we masquerade as
> 	var	$referer		=	"";					// referer info to pass
> 	var $cookies		=	array();			// array of cookies to pass
> 												// $cookies["username"]="joe";
>@@ -61,7 +61,7 @@
> 	var $maxframes		=	0;					// frame content depth maximum. 0 = disallow
> 	var $expandlinks	=	true;				// expand links to fully qualified URLs.
> 												// this only applies to fetchlinks()
>-												// or submitlinks()
>+												// submitlinks(), and submittext()
> 	var $passcookies	=	true;				// pass set cookies back through redirects
> 												// NOTE: this currently does not respect
> 												// dates, domains or paths.
>@@ -137,6 +137,8 @@
> 			$this->pass = $URI_PARTS["pass"];
> 		if (empty($URI_PARTS["query"]))
> 			$URI_PARTS["query"] = '';
>+		if (empty($URI_PARTS["path"]))
>+			$URI_PARTS["path"] = '';
> 				
> 		switch($URI_PARTS["scheme"])
> 		{
>@@ -287,6 +289,8 @@
> 			$this->pass = $URI_PARTS["pass"];
> 		if (empty($URI_PARTS["query"]))
> 			$URI_PARTS["query"] = '';
>+		if (empty($URI_PARTS["path"]))
>+			$URI_PARTS["path"] = '';
> 
> 		switch($URI_PARTS["scheme"])
> 		{
>@@ -438,7 +442,8 @@
> 	{
> 		if ($this->fetch($URI))
> 		{			
>-
>+			if($this->lastredirectaddr)
>+				$URI = $this->lastredirectaddr;
> 			if(is_array($this->results))
> 			{
> 				for($x=0;$x<count($this->results);$x++)
>@@ -518,6 +523,8 @@
> 	{
> 		if($this->submit($URI,$formvars, $formfiles))
> 		{			
>+			if($this->lastredirectaddr)
>+				$URI = $this->lastredirectaddr;
> 			if(is_array($this->results))
> 			{
> 				for($x=0;$x<count($this->results);$x++)
>@@ -550,6 +557,8 @@
> 	{
> 		if($this->submit($URI,$formvars, $formfiles))
> 		{			
>+			if($this->lastredirectaddr)
>+				$URI = $this->lastredirectaddr;
> 			if(is_array($this->results))
> 			{
> 				for($x=0;$x<count($this->results);$x++)
>@@ -739,14 +748,19 @@
> 
> 		$match = preg_replace("|/[^\/\.]+\.[^\/\.]+$|","",$match[0]);
> 		$match = preg_replace("|/$|","",$match);
>+		$match_part = parse_url($match);
>+		$match_root =
>+		$match_part["scheme"]."://".$match_part["host"];
> 				
> 		$search = array( 	"|^http://".preg_quote($this->host)."|i",
>-							"|^(?!http://)(\/)?(?!mailto:)|i",
>+							"|^(\/)|i",
>+							"|^(?!http://)(?!mailto:)|i",
> 							"|/\./|",
> 							"|/[^\/]+/\.\./|"
> 						);
> 						
> 		$replace = array(	"",
>+							$match_root."/",
> 							$match."/",
> 							"/",
> 							"/"
>@@ -979,7 +993,8 @@
> 			$headers[] = "Authorization: BASIC ".base64_encode($this->user.":".$this->pass);
> 			
> 		for($curr_header = 0; $curr_header < count($headers); $curr_header++)
>-			$cmdline_params .= " -H \"".$headers[$curr_header]."\"";
>+			$safer_header = strtr( $headers[$curr_header], "\"", " " );
>+			$cmdline_params .= " -H \"".$safer_header."\"";
> 		
> 		if(!empty($body))
> 			$cmdline_params .= " -d \"$body\"";
>@@ -1037,7 +1052,7 @@
> 
> 		// check if there is a a redirect meta tag
> 		
>-		if(preg_match("'<meta[\s]*http-equiv[^>]*?content[\s]*=[\s]*[\"\']?\d+;[\s]+URL[\s]*=[\s]*([^\"\']*?)[\"\']?>'i",$results,$match))
>+		if(preg_match("'<meta[\s]*http-equiv[^>]*?content[\s]*=[\s]*[\"\']?\d+;[\s]*URL[\s]*=[\s]*([^\"\']*?)[\"\']?>'i",$results,$match))
> 		{
> 			$this->_redirectaddr = $this->_expandlinks($match[1],$URI);	
> 		}

Actions: View | Diff

Attachments on bug 136704: 59711 | 59712