www: d19200f3: A few little cleanups and add some total...

[markdoliner at pidgin.im]

-----------------------------------------------------------------
Revision: d19200f34ed20312f099f746925525cf5025aca9
Ancestor: b7169c6d335c26077486737f3bd513f8d698ee77
Author: markdoliner at pidgin.im
Date: 2009-09-03T19:35:38
Branch: im.pidgin.www
URL: http://d.pidgin.im/viewmtn/revision/info/d19200f34ed20312f099f746925525cf5025aca9

Modified files:
        htdocs/news/security/index.php

ChangeLog: 

A few little cleanups and add some totally untested code that attempts
to link to the revision(s) containing the fix

-------------- next part --------------
============================================================
--- htdocs/news/security/index.php	af23e8b81b590eb644a0e4b8ffc37b5ffe2223a4
+++ htdocs/news/security/index.php	f4cad3bd422c4554ba9335583d0cabdcee596542
@@ -383,9 +383,10 @@ $vulnerabilities = array(
 		"date"         => "3 September 2009",
 		"cve"          => "CVE-2009-3026",
 		"summary"      => "XMPP does not always respect the \"require TLS/SSL\" preference",
-		"description"  => "The XMPP protocol plugin can be tricked into establishing an insecure connection by a malicious man in the middle by causing libpurple to use the older iq-based login and then not offering TLS/SSL.  libpurple 2.6.0 and 2.6.1 are definitely vulnerable.  Older versions are likely vulnerable as well.",
+		"description"  => "The XMPP protocol plugin can be tricked into establishing an insecure connection by a malicious man in the middle by causing libpurple to use the older iq-based login and then not offering TLS/SSL.  libpurple versions less than 2.6.0.",
 		"fix"          => "Respect the \"require TLS/SSL\" preference for this type of connection.",
-		"fixedversion" => "2.6.2",
+		"fixrevisions" => "55897c4ce0787edc1e7721b7f4a9b5cbc8357279",
+		"fixedversion" => "2.6.0",
 		"discoveredby" => "bugdave in <a href=\"http://developer.pidgin.im/ticket/8131\">ticket #8131</a> and Paul Aurich"
 	),
 	array(
@@ -394,7 +395,8 @@ $vulnerabilities = array(
 		"cve"          => "",
 		"summary"      => "XMPP can crash when parsing certain custom smiley responses"
 		"description"  => "The XMPP protocol plugin can crash when attempting to process an error response as a custom smiley.  libpurple 2.5.2 through 2.6.1 are vulnerable.  Older versions may be vulnerable as well.",
-		"fix"          => "Handle error iq responses appropriately",
+		"fix"          => "Handle error iq responses appropriately.",
+		"fixrevisions" => "fd5955618eddcd84d522b30ff11102f9601f38c8",
 		"fixedversion" => "2.6.2",
 		"discoveredby" => "Florob, Waqas, Paul Aurich and Marcus Lundblad"
 	),
@@ -405,6 +407,7 @@ $vulnerabilities = array(
 		"summary"      => "MSN incorrectly handles incoming handwritten messages, which can lead to a crash.",
 		"description"  => "The MSN protocol plugin used an incorrect character encoding when attempting to convert handwritten messages from one encoding to another.  This caused the conversion to fail.  This failure combined with an uninitialized variable can trigger a crash.  The only vulnerable versions of libpurple are 2.6.0 and 2.6.1.",
 		"fix"          => "Use the correct character set name and initialize error to NULL.",
+		"fixrevisions" => "567e16cbc46168f52482e5ec27626c48e7a5ba95",
 		"fixedversion" => "2.6.2",
 		"discoveredby" => "aly89 in <a href=\"http://developer.pidgin.im/ticket/10048\">ticket #10048</a> and Elliott Sales de Andrade"
 	),
@@ -415,16 +418,18 @@ $vulnerabilities = array(
 		"summary"      => "MSN expects certain values to exist, and crashes if they do not",
 		"description"  => "The MSN protocol plugin extracts some fields from an incoming SLP invite.  If some of these fields do not exist in the invite message then the protocol plugin will attempt to dereference a NULL pointer and will crash.",
 		"fix"          => "Check for NULL values and handle appropriately.",
+		"fixrevisions" => "b4a95ea62b81a06ffc1993912471c511b786efdd",
 		"fixedversion" => "2.6.2",
 		"discoveredby" => "blackstar in <a href=\"http://developer.pidgin.im/ticket/10159\">ticket #10159</a> and Elliott Sales de Andrade"
 	),
 	array(
-		"title"        => "IRC title shindig",
+		"title"        => "IRC crash from malicious server",
 		"date"         => "3 September 2009",
 		"cve"          => "CVE-2009-2703",
 		"summary"      => "A malicious server can send an invalid IRC message which triggers a crash",
 		"description"  => "A specially crafted IRC TOPIC message can trigger a NULL pointer dereference in the IRC protocol plugin's code for handling IRC topics.",
 		"fix"          => "Correctly ignore invalid TOPIC messages sent from the server.",
+		"fixrevisions" => "ad2c6ee53ec9122b25aeb1f918db53be69bdeac3",
 		"fixedversion" => "2.6.2",
 		"discoveredby" => "Cristofaro Mune"
 	)
@@ -437,6 +442,7 @@ $vulnerabilities = array(
 		"summary"      => "",
 		"description"  => "",
 		"fix"          => "",
+		"fixrevisions" => "",
 		"fixedversion" => "",
 		"discoveredby" => ""
 	),
@@ -545,6 +551,17 @@ if ($stop > 0) {
   <tr><th>Discovered By</th><td><?=$vun['discoveredby']?></td></tr>
   <tr><th>Summary</th><td><?=$vun['summary']?></td></tr>
   <tr><th>Description</th><td><?=$vun['description']?></td></tr>
+
+  <?
+	// TODO: We should treat fixrevisions like a comma delimited list of
+	//       revisions and linkify each one individually.
+    if (array_key_exists('fixrevisions', $vun)) {
+  ?>
+  <tr><th>Fixed in Revision</th><td><a href="http://developer.pidgin.im/viewmtn/revision/info/<?=$vun['fixedversion']?>"><?=$vun['fixrevisions']?></a></td></tr>
+  <?
+    }
+  ?>
+
   <tr><th>Fixed in Version</th><td><?=$vun['fixedversion']?></td></tr>
   <tr><th>Fix</th><td><?=$vun['fix']?></td></tr>
 </table>