e950a3fd00
Security Updates
+ One of RT's dependencies, the Perl module Email::Address, has a denial
of service vulnerability which could induce a denial of service of RT
itself.
We recommend updating to Email::Address version 1.912 or later. The
Email::Address vulnerabilities are assigned CVE-2015-7686 and CVE-2015-12558.
CVE-2015-7686 was addressed in RT with a previous update.
Email::Address version 1.912 addresses both of these CVEs with updates
directly in the source module.
+ One of RT's dependencies, the Perl module Email::Address::List, relies
on and operates similarly to Email::Address and therefore also has
potential denial of service vulnerabilities.
These vulnerabilities are assigned CVE-2018-18898. We recommend
administrators install Email::Address::List version 0.06 or later.
+ An optional RT dependency, HTML::Gumbo, incorrectly escaped HTML in
some cases. Since RT relies on this module to escape HTML content,
it's possible this issue could allow malicious HTML to be displayed
in RT.
For RT's using this optional module, we recommend administrators
install HTML::Gumbo version 0.18 or later.
* The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting
(XSS) vulnerability when using cross-domain Ajax requests.
This vulnerability is assigned CVE-2015-9251.
RT does not use this jQuery feature so it is not directly vulnerable.
jQuery version 1.12 no longer receives official updates, however a
fix was posted with recommendations for applications to patch locally,
so RT will follow this recommendation and ship with a patched version.
EU General Data Protection Regulation (GDPR)
Several new features were added to support GDPR compliance and are summarized here.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:perl/request-tracker?expand=0&rev=61
48 lines
1.6 KiB
Bash
48 lines
1.6 KiB
Bash
#!/bin/bash
|
|
#
|
|
# This library is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or (at
|
|
# your option) any later version.
|
|
#
|
|
# This library is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# Lesser General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Lesser General Public
|
|
# License along with this library; if not, write to the Free Software
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
#
|
|
|
|
# Default values - can be overwritten by /etc/sysconfig/request-tracker
|
|
RT_CACHEDIR='__RT_CACHEDIR__'
|
|
MASONSTATEDIR='__MASONSTATEDIR__'
|
|
SESSIONSTATEDIR='__SESSIONSTATEDIR__'
|
|
RT_LOGDIR='__RT_LOGDIR__'
|
|
RT_LOCALSTATEDIR='__RT_LOCALSTATEDIR__'
|
|
RT_SHREDDERDIR="$RT_LOCALSTATEDIR/data/RT-Shredder"
|
|
RT_USER='__RT_USER__'
|
|
RT_GROUP='__RT_GROUP__'
|
|
WEB_USER='wwwrun'
|
|
WEB_GROUP='www'
|
|
|
|
# File with user defined values
|
|
RT_SYSCONFIG='/etc/sysconfig/request-tracker'
|
|
|
|
if [ -r "$RT_SYSCONFIG" ]; then
|
|
. "$RT_SYSCONFIG"
|
|
else
|
|
echo "$RT_SYSCONFIG does not exist. Using default values."
|
|
fi
|
|
|
|
for dir in "$RT_CACHEDIR" "$MASONSTATEDIR" "$SESSIONSTATEDIR" "$RT_LOGDIR" "$RT_LOCALSTATEDIR" ; do
|
|
if [ ! -d "$dir" ]; then
|
|
/bin/mkdir -p "$dir"
|
|
/bin/chown $RT_USER:$RT_GROUP "$dir"
|
|
fi
|
|
done
|
|
/bin/mkdir -p "$RT_SHREDDERDIR" 2>/dev/null
|
|
/bin/chown $WEB_USER:$WEB_GROUP "$RT_SHREDDERDIR"
|
|
|