summaryrefslogtreecommitdiff
path: root/debian/patches
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches')
-rw-r--r--debian/patches/011_fix_version_display.patch72
-rw-r--r--debian/patches/012_disable_version_check.patch64
-rw-r--r--debian/patches/021_multisite.patch474
-rw-r--r--debian/patches/022_multisite_installer.patch128
-rw-r--r--debian/patches/031_fix_installer.patch37
-rw-r--r--debian/patches/add_phpbb_prefix_to_ldap_escape.patch31
-rw-r--r--debian/patches/fix_CVE-2015-1431.patch70
-rw-r--r--debian/patches/fix_CVE-2015-1432.patch27
-rw-r--r--debian/patches/fix_CVE-2015-3880.patch32
-rw-r--r--debian/patches/fix_chown.patch43
-rw-r--r--debian/patches/improve_php_5.6_compatibility.patch45
-rw-r--r--debian/patches/privacy-breach-generic.patch27
-rw-r--r--debian/patches/series12
13 files changed, 1062 insertions, 0 deletions
diff --git a/debian/patches/011_fix_version_display.patch b/debian/patches/011_fix_version_display.patch
new file mode 100644
index 0000000..00ff4fd
--- /dev/null
+++ b/debian/patches/011_fix_version_display.patch
@@ -0,0 +1,72 @@
+Author: Jeroen van Wolffelaar <jeroen@wolffelaar.nl>
+Description: Overrides the version display, such that it is clear a Debian package is used.
+Last-Update: 2013-09-28
+--- a/adm/index.php
++++ b/adm/index.php
+@@ -200,7 +200,7 @@
+ 'TRANSLATION_INFO' => (!empty($user->lang['TRANSLATION_INFO'])) ? $user->lang['TRANSLATION_INFO'] : '',
+ 'S_COPYRIGHT_HTML' => $copyright_html,
+ 'CREDIT_LINE' => $user->lang('POWERED_BY', '<a href="https://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group'),
+- 'VERSION' => $config['version'])
++ 'VERSION' => PHPBB_VERSION)
+ );
+
+ $template->display('body');
+--- a/common.php
++++ b/common.php
+@@ -16,6 +16,8 @@
+ exit;
+ }
+
++define('PHPBB_VERSION', '@VERSION@');
++
+ require($phpbb_root_path . 'includes/startup.' . $phpEx);
+
+ if (file_exists($phpbb_root_path . 'config.' . $phpEx))
+--- a/includes/acp/acp_styles.php
++++ b/includes/acp/acp_styles.php
+@@ -2034,7 +2034,7 @@
+
+ if ($mode == 'style')
+ {
+- $style_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['style_name'], $style_row['style_copyright'], $config['version']), $this->style_cfg);
++ $style_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['style_name'], $style_row['style_copyright'], PHPBB_VERSION), $this->style_cfg);
+
+ $style_cfg .= (!$inc_template) ? "\nrequired_template = {$style_row['template_name']}" : '';
+ $style_cfg .= (!$inc_theme) ? "\nrequired_theme = {$style_row['theme_name']}" : '';
+@@ -2065,7 +2065,7 @@
+ $db->sql_freeresult($result);
+ }
+
+- $template_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}', '{INHERIT_FROM}'), array($mode, $style_row['template_name'], $style_row['template_copyright'], $config['version'], $use_template_name), $this->template_cfg);
++ $template_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}', '{INHERIT_FROM}'), array($mode, $style_row['template_name'], $style_row['template_copyright'], PHPBB_VERSION, $use_template_name), $this->template_cfg);
+
+ $template_cfg .= "\n\nbbcode_bitfield = {$style_row['bbcode_bitfield']}";
+
+@@ -2106,7 +2106,7 @@
+ // Export theme core code
+ if ($mode == 'theme' || $inc_theme)
+ {
+- $theme_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['theme_name'], $style_row['theme_copyright'], $config['version']), $this->theme_cfg);
++ $theme_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['theme_name'], $style_row['theme_copyright'], PHPBB_VERSION), $this->theme_cfg);
+
+ // Read old cfg file
+ $items = $cache->obtain_cfg_items($style_row);
+@@ -2145,7 +2145,7 @@
+ // Export imageset core code
+ if ($mode == 'imageset' || $inc_imageset)
+ {
+- $imageset_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['imageset_name'], $style_row['imageset_copyright'], $config['version']), $this->imageset_cfg);
++ $imageset_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['imageset_name'], $style_row['imageset_copyright'], PHPBB_VERSION), $this->imageset_cfg);
+
+ $imageset_main = array();
+
+@@ -2214,7 +2214,7 @@
+
+ foreach ($imageset_lang as $lang => $imageset_localized)
+ {
+- $imageset_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['imageset_name'], $style_row['imageset_copyright'], $config['version']), $this->imageset_cfg);
++ $imageset_cfg = str_replace(array('{MODE}', '{NAME}', '{COPYRIGHT}', '{VERSION}'), array($mode, $style_row['imageset_name'], $style_row['imageset_copyright'], PHPBB_VERSION), $this->imageset_cfg);
+
+ foreach ($this->imageset_keys as $topic => $key_array)
+ {
diff --git a/debian/patches/012_disable_version_check.patch b/debian/patches/012_disable_version_check.patch
new file mode 100644
index 0000000..a08c8c6
--- /dev/null
+++ b/debian/patches/012_disable_version_check.patch
@@ -0,0 +1,64 @@
+Author: Jeroen van Wolffelaar <jeroen@wolffelaar.nl>
+Description: Disables upstream version check.
+Last-Update: 2013-09-28
+--- a/includes/acp/acp_update.php
++++ b/includes/acp/acp_update.php
+@@ -32,7 +32,7 @@
+
+ $this->tpl_name = 'acp_update';
+ $this->page_title = 'ACP_VERSION_CHECK';
+-
++/*
+ // Get current and latest version
+ $errstr = '';
+ $errno = 0;
+@@ -68,20 +68,20 @@
+ $db->sql_freeresult($result);
+
+ $current_version = (!empty($version_update_from)) ? $version_update_from : $config['version'];
+-
++*/
+ $template->assign_vars(array(
+- 'S_UP_TO_DATE' => phpbb_version_compare($latest_version, $config['version'], '<='),
+- 'S_UP_TO_DATE_AUTO' => phpbb_version_compare($latest_version, $current_version, '<='),
++ 'S_UP_TO_DATE' => true,
++ 'S_UP_TO_DATE_AUTO' => true,
+ 'S_VERSION_CHECK' => true,
+ 'U_ACTION' => $this->u_action,
+ 'U_VERSIONCHECK_FORCE' => append_sid($this->u_action . '&amp;versioncheck_force=1'),
+
+- 'LATEST_VERSION' => $latest_version,
+- 'CURRENT_VERSION' => $config['version'],
+- 'AUTO_VERSION' => $version_update_from,
++ 'LATEST_VERSION' => 'See <a href="http://packages.debian.org/phpbb3">Debian Packages</a>',
++ 'CURRENT_VERSION' => PHPBB_VERSION,
++ 'AUTO_VERSION' => 'See <a href="http://packages.debian.org/phpbb3">Debian Packages</a>',
+ 'NEXT_FEATURE_VERSION' => $next_feature_version,
+
+- 'UPDATE_INSTRUCTIONS' => sprintf($user->lang['UPDATE_INSTRUCTIONS'], $announcement_url, $update_link),
++ 'UPDATE_INSTRUCTIONS' => 'You are using the Debian package of phpBB. Check <a href="http://packages.debian.org/phpbb3">packages.debian.org</a> for updates.',
+ 'UPGRADE_INSTRUCTIONS' => $next_feature_version ? $user->lang('UPGRADE_INSTRUCTIONS', $next_feature_version, $next_feature_announcement_url) : false,
+ ));
+ }
+--- a/includes/acp/acp_main.php
++++ b/includes/acp/acp_main.php
+@@ -405,7 +405,7 @@
+ 'L_PHP_VERSION_OLD' => sprintf($user->lang['PHP_VERSION_OLD'], '<a href="https://www.phpbb.com/community/viewtopic.php?f=14&amp;t=2152375">', '</a>'),
+ ));
+ }
+-
++/*
+ $latest_version_info = false;
+ if (($latest_version_info = obtain_latest_version_info(request_var('versioncheck_force', false))) === false)
+ {
+@@ -419,6 +419,10 @@
+ 'S_VERSION_UP_TO_DATE' => phpbb_version_compare(trim($latest_version_info[0]), $config['version'], '<='),
+ ));
+ }
++*/
++ $template->assign_vars(array(
++ 'S_VERSION_UP_TO_DATE' => true,
++ ));
+
+ // Get forum statistics
+ $total_posts = $config['num_posts'];
diff --git a/debian/patches/021_multisite.patch b/debian/patches/021_multisite.patch
new file mode 100644
index 0000000..cff5bc3
--- /dev/null
+++ b/debian/patches/021_multisite.patch
@@ -0,0 +1,474 @@
+Author: David Prévot <david@tilapin.org>
+Reviewed-by: J.M. Roth <jmroth@iip.lu>
+Description: Makes caches, file uploads, etc. work when multiple forums use the same codebase.
+Bug-Debian: http://bugs.debian.org/437836
+Last-Update: 2013-09-28
+--- a/cron.php
++++ b/cron.php
+@@ -72,7 +72,9 @@
+ {
+ case 'queue':
+
+- if (time() - $config['queue_interval'] <= $config['last_queue_run'] || !file_exists($phpbb_root_path . 'cache/queue.' . $phpEx))
++ global $url_forum;
++
++ if (time() - $config['queue_interval'] <= $config['last_queue_run'] || !file_exists($phpbb_root_path . 'cache/' . $url_forum . '/queue.' . $phpEx))
+ {
+ break;
+ }
+--- a/includes/acm/acm_file.php
++++ b/includes/acm/acm_file.php
+@@ -35,8 +35,16 @@
+ */
+ function acm()
+ {
+- global $phpbb_root_path;
+- $this->cache_dir = $phpbb_root_path . 'cache/';
++ global $phpbb_root_path, $url_forum;
++
++ $cache = $phpbb_root_path . 'cache/' . $url_forum . '/';
++
++ if (!file_exists($cache)) {
++ mkdir($cache);
++ }
++ @chmod($cache, 0750);
++
++ $this->cache_dir = $cache;
+ }
+
+ /**
+--- a/includes/acp/acp_database.php
++++ b/includes/acp/acp_database.php
+@@ -27,7 +27,11 @@
+ function main($id, $mode)
+ {
+ global $cache, $db, $user, $auth, $template, $table_prefix;
+- global $config, $phpbb_root_path, $phpbb_admin_path, $phpEx;
++ global $config, $phpbb_root_path, $phpbb_admin_path, $phpEx, $url_forum;
++
++ if (!file_exists("$phpbb_root_path/store/$url_forum")) {
++ mkdir("$phpbb_root_path/store/$url_forum", 0750);
++ }
+
+ if (!class_exists('phpbb_db_tools'))
+ {
+@@ -234,7 +238,7 @@
+ trigger_error($user->lang['BACKUP_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+ }
+
+- $file_name = $phpbb_root_path . 'store/' . $matches[0];
++ $file_name = $phpbb_root_path . 'store/'. $url_forum. '/' . $matches[0];
+
+ if (!file_exists($file_name) || !is_readable($file_name))
+ {
+@@ -434,7 +438,7 @@
+ $methods[] = $type;
+ }
+
+- $dir = $phpbb_root_path . 'store/';
++ $dir = $phpbb_root_path . 'store/'. $url_forum. '/';
+ $dh = @opendir($dir);
+
+ $backup_files = array();
+@@ -553,8 +557,8 @@
+
+ if ($store == true)
+ {
+- global $phpbb_root_path;
+- $file = $phpbb_root_path . 'store/' . $filename . $ext;
++ global $phpbb_root_path, $url_forum;
++ $file = $phpbb_root_path . 'store/'. $url_forum. '/' . $filename . $ext;
+
+ $this->fp = $open($file, 'w');
+
+--- a/includes/acp/acp_language.php
++++ b/includes/acp/acp_language.php
+@@ -34,6 +34,7 @@
+ global $config, $db, $user, $auth, $template, $cache;
+ global $phpbb_root_path, $phpbb_admin_path, $phpEx, $table_prefix;
+ global $safe_mode, $file_uploads;
++ global $url_forum;
+
+ include_once($phpbb_root_path . 'includes/functions_user.' . $phpEx);
+
+@@ -269,15 +270,15 @@
+
+ foreach ($mkdir_ary as $dir)
+ {
+- $dir = $phpbb_root_path . 'store/' . $dir;
++ $dir = $phpbb_root_path . 'store/' . $url_forum . '/' . $dir;
+
+ if (!is_dir($dir))
+ {
+- if (!@mkdir($dir, 0777))
++ if (!@mkdir($dir, 0777, true))
+ {
+ trigger_error("Could not create directory $dir", E_USER_ERROR);
+ }
+- @chmod($dir, 0777);
++ @chmod($dir, 0750);
+ }
+ }
+ }
+@@ -398,7 +399,7 @@
+ }
+
+ $transfer->rename($lang_path . $file, $lang_path . $file . '.bak');
+- $result = $transfer->copy_file('store/' . $lang_path . $file, $lang_path . $file);
++ $result = $transfer->copy_file('store/' . $url_forum . '/' . $lang_path . $file, $lang_path . $file);
+
+ if ($result === false)
+ {
+@@ -412,9 +413,9 @@
+ $transfer->close_session();
+
+ // Remove from storage folder
+- if (file_exists($phpbb_root_path . 'store/' . $lang_path . $file))
++ if (file_exists($phpbb_root_path . 'store/' . $url_forum . '/' . $lang_path . $file))
+ {
+- @unlink($phpbb_root_path . 'store/' . $lang_path . $file);
++ @unlink($phpbb_root_path . 'store/' . $url_forum . '/' . $lang_path . $file);
+ }
+
+ add_log('admin', 'LOG_LANGUAGE_FILE_REPLACED', $file);
+@@ -1016,13 +1017,18 @@
+
+ include_once($phpbb_root_path . 'includes/functions_compress.' . $phpEx);
+
++ // create subdir in store before writing to it
++ if (!@mkdir($phpbb_root_path . 'store/' . $url_forum, 0750, true))
++ {
++ trigger_error("Could not create directory store/$url_forum", E_USER_ERROR);
++ }
+ if ($use_method == '.zip')
+ {
+- $compress = new compress_zip('w', $phpbb_root_path . 'store/lang_' . $row['lang_iso'] . $use_method);
++ $compress = new compress_zip('w', $phpbb_root_path . 'store/' . $url_forum . '/' . 'lang_' . $row['lang_iso'] . $use_method);
+ }
+ else
+ {
+- $compress = new compress_tar('w', $phpbb_root_path . 'store/lang_' . $row['lang_iso'] . $use_method, $use_method);
++ $compress = new compress_tar('w', $phpbb_root_path . 'store/' . $url_forum . '/' . 'lang_' . $row['lang_iso'] . $use_method, $use_method);
+ }
+
+ // Get email templates
+@@ -1075,7 +1081,7 @@
+ $compress->close();
+
+ $compress->download('lang_' . $row['lang_iso']);
+- @unlink($phpbb_root_path . 'store/lang_' . $row['lang_iso'] . $use_method);
++ @unlink($phpbb_root_path . 'store/' . $url_forum . '/' . 'lang_' . $row['lang_iso'] . $use_method);
+
+ exit;
+
+@@ -1232,13 +1238,13 @@
+ */
+ function get_filename($lang_iso, $directory, $filename, $check_store = false, $only_return_filename = false)
+ {
+- global $phpbb_root_path, $safe_mode;
++ global $phpbb_root_path, $safe_mode, $url_forum;
+
+ $check_filename = "language/$lang_iso/" . (($directory) ? $directory . '/' : '') . $filename;
+
+ if ($check_store)
+ {
+- $check_store_filename = ($safe_mode) ? "store/langfile_{$lang_iso}" . (($directory) ? '_' . $directory : '') . "_{$filename}" : "store/language/$lang_iso/" . (($directory) ? $directory . '/' : '') . $filename;
++ $check_store_filename = ($safe_mode) ? "store/$url_forum/langfile_{$lang_iso}" . (($directory) ? '_' . $directory : '') . "_{$filename}" : "store/$url_forum/language/$lang_iso/" . (($directory) ? $directory . '/' : '') . $filename;
+
+ if (!$only_return_filename && file_exists($phpbb_root_path . $check_store_filename))
+ {
+--- a/includes/acp/acp_styles.php
++++ b/includes/acp/acp_styles.php
+@@ -953,7 +953,7 @@
+ */
+ function template_cache($template_id)
+ {
+- global $phpbb_root_path, $phpEx, $config, $db, $cache, $user, $template;
++ global $phpbb_root_path, $phpEx, $config, $db, $cache, $user, $template, $url_forum;
+
+ $source = str_replace('/', '.', request_var('source', ''));
+ $file_ary = array_diff(request_var('delete', array('')), array(''));
+@@ -983,7 +983,7 @@
+ // Someone wants to see the cached source ... so we'll highlight it,
+ // add line numbers and indent it appropriately. This could be nasty
+ // on larger source files ...
+- if ($source && file_exists("{$phpbb_root_path}cache/{$cache_prefix}_$source.html.$phpEx"))
++ if ($source && file_exists("{$phpbb_root_path}cache/$url_forum/{$cache_prefix}_$source.html.$phpEx"))
+ {
+ adm_page_header($user->lang['TEMPLATE_CACHE']);
+
+@@ -995,7 +995,7 @@
+ 'FILENAME' => str_replace('.', '/', $source) . '.html')
+ );
+
+- $code = str_replace(array("\r\n", "\r"), array("\n", "\n"), file_get_contents("{$phpbb_root_path}cache/{$cache_prefix}_$source.html.$phpEx"));
++ $code = str_replace(array("\r\n", "\r"), array("\n", "\n"), file_get_contents("{$phpbb_root_path}cache/$url_forum/{$cache_prefix}_$source.html.$phpEx"));
+
+ $conf = array('highlight.bg', 'highlight.comment', 'highlight.default', 'highlight.html', 'highlight.keyword', 'highlight.string');
+ foreach ($conf as $ini_var)
+@@ -1070,7 +1070,7 @@
+
+ $filename = "{$cache_prefix}_$file.html.$phpEx";
+
+- if (!file_exists("{$phpbb_root_path}cache/$filename"))
++ if (!file_exists("{$phpbb_root_path}cache/$url_forum/$filename"))
+ {
+ continue;
+ }
+@@ -1107,10 +1107,10 @@
+ $template->assign_block_vars('file', array(
+ 'U_VIEWSOURCE' => $this->u_action . "&amp;action=cache&amp;id=$template_id&amp;source=$file",
+
+- 'CACHED' => $user->format_date(filemtime("{$phpbb_root_path}cache/$filename")),
++ 'CACHED' => $user->format_date(filemtime("{$phpbb_root_path}cache/$url_forum/$filename")),
+ 'FILENAME' => $file,
+ 'FILENAME_PATH' => $file_tpl,
+- 'FILESIZE' => get_formatted_filesize(filesize("{$phpbb_root_path}cache/$filename")),
++ 'FILESIZE' => get_formatted_filesize(filesize("{$phpbb_root_path}cache/$url_forum/$filename")),
+ 'MODIFIED' => $user->format_date((!$template_row['template_storedb']) ? filemtime($file_tpl) : $filemtime[$file . '.html']))
+ );
+ }
+@@ -1926,7 +1926,7 @@
+ */
+ function export($mode, $style_id)
+ {
+- global $db, $template, $user, $phpbb_root_path, $cache, $phpEx, $config;
++ global $db, $template, $user, $phpbb_root_path, $cache, $phpEx, $config, $url_forum;
+
+ $update = (isset($_POST['update'])) ? true : false;
+
+@@ -2271,13 +2271,17 @@
+ $path = $style_row[$mode . '_path'];
+ }
+
++ if (!file_exists("$phpbb_root_path/store/$url_forum")) {
++ mkdir("$phpbb_root_path/store/$url_forum", 0750);
++ }
++
+ if ($format == 'zip')
+ {
+- $compress = new compress_zip('w', $phpbb_root_path . "store/$path$ext");
++ $compress = new compress_zip('w', $phpbb_root_path . "store/$url_forum/$path$ext");
+ }
+ else
+ {
+- $compress = new compress_tar('w', $phpbb_root_path . "store/$path$ext", $ext);
++ $compress = new compress_tar('w', $phpbb_root_path . "store/$url_forum/$path$ext", $ext);
+ }
+
+ if (sizeof($files))
+@@ -2303,11 +2307,11 @@
+ if (!$store)
+ {
+ $compress->download($path);
+- @unlink("{$phpbb_root_path}store/$path$ext");
++ @unlink("{$phpbb_root_path}store/$url_forum/$path$ext");
+ exit;
+ }
+
+- trigger_error(sprintf($user->lang[$l_prefix . '_EXPORTED'], "store/$path$ext") . adm_back_link($this->u_action));
++ trigger_error(sprintf($user->lang[$l_prefix . '_EXPORTED'], "store/$url_forum/$path$ext") . adm_back_link($this->u_action));
+ }
+ }
+
+@@ -2835,11 +2839,11 @@
+ */
+ function template_cache_filelist($template_path)
+ {
+- global $phpbb_root_path, $phpEx, $user;
++ global $phpbb_root_path, $phpEx, $user, $url_forum;
+
+ $cache_prefix = 'tpl_' . str_replace('_', '-', $template_path);
+
+- if (!($dp = @opendir("{$phpbb_root_path}cache")))
++ if (!($dp = @opendir("{$phpbb_root_path}cache/$url_forum")))
+ {
+ trigger_error($user->lang['TEMPLATE_ERR_CACHE_READ'] . adm_back_link($this->u_action), E_USER_WARNING);
+ }
+@@ -2852,7 +2856,7 @@
+ continue;
+ }
+
+- if (is_file($phpbb_root_path . 'cache/' . $file) && (strpos($file, $cache_prefix) === 0))
++ if (is_file($phpbb_root_path . 'cache/' . $url_forum . '/' . $file) && (strpos($file, $cache_prefix) === 0))
+ {
+ $file_ary[] = str_replace('.', '/', preg_replace('#^' . preg_quote($cache_prefix, '#') . '_(.*?)\.html\.' . $phpEx . '$#i', '\1', $file));
+ }
+@@ -2871,7 +2875,7 @@
+ */
+ function clear_template_cache($template_row, $file_ary = false)
+ {
+- global $phpbb_root_path, $phpEx, $user;
++ global $phpbb_root_path, $phpEx, $user, $url_forum;
+
+ $cache_prefix = 'tpl_' . str_replace('_', '-', $template_row['template_path']);
+
+@@ -2889,7 +2893,7 @@
+ {
+ $file = str_replace('/', '.', $file);
+
+- $file = "{$phpbb_root_path}cache/{$cache_prefix}_$file.html.$phpEx";
++ $file = "{$phpbb_root_path}cache/$url_forum/{$cache_prefix}_$file.html.$phpEx";
+ if (file_exists($file) && is_file($file))
+ {
+ @unlink($file);
+--- a/includes/functions.php
++++ b/includes/functions.php
+@@ -4769,7 +4769,7 @@
+ */
+ function page_footer($run_cron = true)
+ {
+- global $db, $config, $template, $user, $auth, $cache, $starttime, $phpbb_root_path, $phpEx;
++ global $db, $config, $template, $user, $auth, $cache, $starttime, $phpbb_root_path, $phpEx, $url_forum;
+
+ // Output page creation time
+ if (defined('DEBUG'))
+@@ -4835,7 +4835,7 @@
+ {
+ $cron_type = '';
+
+- if ($time_now - $config['queue_interval'] > $config['last_queue_run'] && !defined('IN_ADMIN') && file_exists($phpbb_root_path . 'cache/queue.' . $phpEx))
++ if ($time_now - $config['queue_interval'] > $config['last_queue_run'] && !defined('IN_ADMIN') && file_exists($phpbb_root_path . 'cache/' . $url_forum . '/queue.' . $phpEx))
+ {
+ // Process email queue
+ $cron_type = 'queue';
+--- a/includes/functions_compress.php
++++ b/includes/functions_compress.php
+@@ -462,7 +462,7 @@
+ */
+ function download($filename, $download_name = false)
+ {
+- global $phpbb_root_path;
++ global $phpbb_root_path, $url_forum;
+
+ if ($download_name === false)
+ {
+@@ -475,7 +475,7 @@
+ header("Content-Type: $mimetype; name=\"$download_name.zip\"");
+ header("Content-disposition: attachment; filename=$download_name.zip");
+
+- $fp = @fopen("{$phpbb_root_path}store/$filename.zip", 'rb');
++ $fp = @fopen("{$phpbb_root_path}store/$url_forum/$filename.zip", 'rb');
+ if ($fp)
+ {
+ while ($buffer = fread($fp, 1024))
+@@ -694,7 +694,7 @@
+ */
+ function download($filename, $download_name = false)
+ {
+- global $phpbb_root_path;
++ global $phpbb_root_path, $url_forum;
+
+ if ($download_name === false)
+ {
+@@ -724,7 +724,7 @@
+ header("Content-Type: $mimetype; name=\"$download_name$this->type\"");
+ header("Content-disposition: attachment; filename=$download_name$this->type");
+
+- $fp = @fopen("{$phpbb_root_path}store/$filename$this->type", 'rb');
++ $fp = @fopen("{$phpbb_root_path}store/$url_forum/$filename$this->type", 'rb');
+ if ($fp)
+ {
+ while ($buffer = fread($fp, 1024))
+--- a/includes/functions_messenger.php
++++ b/includes/functions_messenger.php
+@@ -641,10 +641,10 @@
+ */
+ function queue()
+ {
+- global $phpEx, $phpbb_root_path;
++ global $phpEx, $phpbb_root_path, $url_forum;
+
+ $this->data = array();
+- $this->cache_file = "{$phpbb_root_path}cache/queue.$phpEx";
++ $this->cache_file = "{$phpbb_root_path}cache/$url_forum/queue.$phpEx";
+
+ // Determine EOL character (\n for UNIX, \r\n for Windows and \r for Mac)
+ $this->eol = (!defined('PHP_EOL')) ? (($eol = strtolower(substr(PHP_OS, 0, 3))) == 'win') ? "\r\n" : (($eol == 'mac') ? "\r" : "\n") : PHP_EOL;
+--- a/includes/functions_posting.php
++++ b/includes/functions_posting.php
+@@ -453,6 +453,7 @@
+ $no_image = ($cat_id == ATTACHMENT_CATEGORY_IMAGE) ? false : true;
+
+ $file->move_file($config['upload_path'], false, $no_image);
++ chmod($config['upload_path'].'/'.$file->realname, 0640);
+
+ if (sizeof($file->error))
+ {
+--- a/includes/functions_transfer.php
++++ b/includes/functions_transfer.php
+@@ -38,13 +38,13 @@
+ */
+ function transfer()
+ {
+- global $phpbb_root_path;
++ global $phpbb_root_path, $url_forum;
+
+ $this->file_perms = 0644;
+ $this->dir_perms = 0777;
+
+ // We use the store directory as temporary path to circumvent open basedir restrictions
+- $this->tmp_path = $phpbb_root_path . 'store/';
++ $this->tmp_path = $phpbb_root_path . 'store/'. $url_forum. '/';
+ }
+
+ /**
+--- a/includes/functions_user.php
++++ b/includes/functions_user.php
+@@ -2091,6 +2091,7 @@
+
+ // Move file and overwrite any existing image
+ $file->move_file($destination, true);
++ chmod("$destination/".$file->realname, 0640);
+
+ if (sizeof($file->error))
+ {
+--- a/includes/template.php
++++ b/includes/template.php
+@@ -51,12 +51,12 @@
+ */
+ function set_template()
+ {
+- global $phpbb_root_path, $user;
++ global $phpbb_root_path, $user, $url_forum;
+
+ if (file_exists($phpbb_root_path . 'styles/' . $user->theme['template_path'] . '/template'))
+ {
+ $this->root = $phpbb_root_path . 'styles/' . $user->theme['template_path'] . '/template';
+- $this->cachepath = $phpbb_root_path . 'cache/tpl_' . str_replace('_', '-', $user->theme['template_path']) . '_';
++ $this->cachepath = $phpbb_root_path . 'cache/' . $url_forum . '/tpl_' . str_replace('_', '-', $user->theme['template_path']) . '_';
+
+ if ($this->orig_tpl_storedb === null)
+ {
+@@ -92,7 +92,7 @@
+ */
+ function set_custom_template($template_path, $template_name, $fallback_template_path = false)
+ {
+- global $phpbb_root_path, $user;
++ global $phpbb_root_path, $user, $url_forum;
+
+ // Make sure $template_path has no ending slash
+ if (substr($template_path, -1) == '/')
+@@ -101,7 +101,7 @@
+ }
+
+ $this->root = $template_path;
+- $this->cachepath = $phpbb_root_path . 'cache/ctpl_' . str_replace('_', '-', $template_name) . '_';
++ $this->cachepath = $phpbb_root_path . 'cache/' . $url_forum . '/ctpl_' . str_replace('_', '-', $template_name) . '_';
+
+ if ($fallback_template_path !== false)
+ {
+--- a/includes/acm/acm_memory.php
++++ b/includes/acm/acm_memory.php
+@@ -36,9 +36,9 @@
+ */
+ function acm_memory()
+ {
+- global $phpbb_root_path, $dbname, $table_prefix;
++ global $phpbb_root_path, $dbname, $table_prefix, $url_forum;
+
+- $this->cache_dir = $phpbb_root_path . 'cache/';
++ $this->cache_dir = $phpbb_root_path . 'cache/' . $url_forum . '/';
+ $this->key_prefix = substr(md5($dbname . $table_prefix), 0, 8) . '_';
+
+ if (!isset($this->extension) || !extension_loaded($this->extension))
diff --git a/debian/patches/022_multisite_installer.patch b/debian/patches/022_multisite_installer.patch
new file mode 100644
index 0000000..fa1c5b3
--- /dev/null
+++ b/debian/patches/022_multisite_installer.patch
@@ -0,0 +1,128 @@
+Author: J.M. Roth <jmroth@iip.lu>
+Description: Modifies the newly shipped installer to
+ - NOT show convert tab
+ - be able to run even though config.php is there (which in Debian, it is always)
+ - remove output that has no meaning/is confusing here or links to unexisting files
+Last-Update: 2013-09-28
+--- a/install/database_update.php
++++ b/install/database_update.php
+@@ -67,7 +67,7 @@
+
+ if (!defined('PHPBB_INSTALLED') || empty($dbms) || empty($acm_type))
+ {
+- die("Please read: <a href='../docs/INSTALL.html'>INSTALL.html</a> before attempting to update.");
++ die("Make sure you have a running board before trying to upgrade anything.");
+ }
+
+ // Load Extensions
+--- a/install/index.php
++++ b/install/index.php
+@@ -244,14 +244,14 @@
+ }
+
+ $setmodules = 1;
+- while (($file = readdir($dir)) !== false)
++ while (($file = readdir()) !== false)
+ {
+ if (preg_match('#^install_(.*?)\.' . $phpEx . '$#', $file))
+ {
+ include($file);
+ }
+ }
+- closedir($dir);
++ closedir();
+
+ unset($setmodules);
+
+--- a/install/install_convert.php
++++ b/install/install_convert.php
+@@ -10,7 +10,7 @@
+
+ /**
+ */
+-
++return;
+ if (!defined('IN_INSTALL'))
+ {
+ // Someone has tried to access the file direct. This is not a good idea, so exit
+--- a/install/install_install.php
++++ b/install/install_install.php
+@@ -23,7 +23,7 @@
+ {
+ include_once($phpbb_root_path . 'config.' . $phpEx);
+
+- if (defined('PHPBB_INSTALLED'))
++ if (empty($GLOBALS['dbhost']))
+ {
+ return;
+ }
+@@ -947,8 +947,8 @@
+ if (isset($_POST['dlconfig']))
+ {
+ // They want a copy of the file to download, so send the relevant headers and dump out the data
+- header("Content-Type: text/x-delimtext; name=\"config.$phpEx\"");
+- header("Content-disposition: attachment; filename=config.$phpEx");
++ header("Content-Type: text/x-delimtext; name=\"alternate_config.$phpEx\"");
++ header("Content-disposition: attachment; filename=alternate_config.$phpEx");
+ echo $config_data;
+ exit;
+ }
+@@ -1026,6 +1026,7 @@
+
+ // Replace backslashes and doubled slashes (could happen on some proxy setups)
+ $name = str_replace(array('\\', '//'), '/', $name);
++ $name = preg_replace('#/-\w*?/#', '/', $name);
+ $data['script_path'] = trim(dirname(dirname($name)));
+ }
+
+@@ -1366,6 +1367,19 @@
+ WHERE config_name = 'captcha_gd'";
+ }
+
++ $db_debian = array( // config table (name,value) pairs
++ 'sitename' => 'Your new phpBB board',
++ 'site_desc' => 'Powered by Debian',
++ 'board_disable' => '1',
++ 'captcha_gd_x_grid' => rand(11,24),
++ 'captcha_gd_y_grid' => rand(6,24),
++ );
++ foreach ($db_debian as $n => $v) {
++ $sql_ary[] = 'UPDATE ' . $data['table_prefix'] . "config
++ SET config_value = '$v'
++ WHERE config_name = '$n'";
++ }
++
+ $ref = substr($referer, strpos($referer, '://') + 3);
+
+ if (!(stripos($ref, $server_name) === 0))
+@@ -1939,7 +1953,7 @@
+
+ $template->assign_vars(array(
+ 'TITLE' => $lang['INSTALL_CONGRATS'],
+- 'BODY' => sprintf($lang['INSTALL_CONGRATS_EXPLAIN'], $config['version'], append_sid($phpbb_root_path . 'install/index.' . $phpEx, 'mode=convert&amp;language=' . $data['language']), '../docs/README.html'),
++ 'BODY' => '',
+ 'L_SUBMIT' => $lang['INSTALL_LOGIN'],
+ 'U_ACTION' => append_sid($phpbb_root_path . 'adm/index.' . $phpEx, 'i=send_statistics&amp;mode=send_statistics'),
+ ));
+--- a/install/install_main.php
++++ b/install/install_main.php
+@@ -24,7 +24,7 @@
+ 'module_title' => 'OVERVIEW',
+ 'module_filename' => substr(basename(__FILE__), 0, -strlen($phpEx)-1),
+ 'module_order' => 0,
+- 'module_subs' => array('INTRO', 'LICENSE', 'SUPPORT'),
++ 'module_subs' => array('INTRO'),
+ 'module_stages' => '',
+ 'module_reqs' => ''
+ );
+--- a/language/en/install.php
++++ b/language/en/install.php
+@@ -288,7 +288,7 @@
+ 'NO_LOCATION' => 'Cannot determine location. If you know Imagemagick is installed, you may specify the location later within your administration control panel',
+ 'NO_TABLES_FOUND' => 'No tables found.',
+
+- 'OVERVIEW_BODY' => 'Welcome to phpBB3!<br /><br />phpBB® is the most widely used open source bulletin board solution in the world. phpBB3 is the latest installment in a package line started in 2000. Like its predecessors, phpBB3 is feature-rich, user-friendly, and fully supported by the phpBB Team. phpBB3 greatly improves on what made phpBB2 popular, and adds commonly requested features that were not present in previous versions. We hope it exceeds your expectations.<br /><br />This installation system will guide you through installing phpBB3, updating to the latest version of phpBB3 from past releases, as well as converting to phpBB3 from a different discussion board system (including phpBB2). For more information, we encourage you to read <a href="../docs/INSTALL.html">the installation guide</a>.<br /><br />To read the phpBB3 license or learn about obtaining support and our stance on it, please select the respective options from the side menu. To continue, please select the appropriate tab above.',
++ 'OVERVIEW_BODY' => 'Welcome to phpBB3!<br /><br />If you want to use the Database Updater to update your (multisite) database manually, <a href="database_update.php">click here</a>. Remember that you have to do this for each one of your forums after each application update.',
+
+ 'PCRE_UTF_SUPPORT' => 'PCRE UTF-8 support',
+ 'PCRE_UTF_SUPPORT_EXPLAIN' => 'phpBB will <strong>not</strong> run if your PHP installation is not compiled with UTF-8 support in the PCRE extension.',
diff --git a/debian/patches/031_fix_installer.patch b/debian/patches/031_fix_installer.patch
new file mode 100644
index 0000000..070fafc
--- /dev/null
+++ b/debian/patches/031_fix_installer.patch
@@ -0,0 +1,37 @@
+Author: David Prévot <david@tilapin.org>
+Description: Fix PHPBB_ROOT_PATH in install-XXX (used in multiboard).
+Bug-Debian: http://bugs.debian.org/644276
+Last-Update: 2011-11-11
+--- a/install/database_update.php
++++ b/install/database_update.php
+@@ -31,6 +31,8 @@
+ define('IN_PHPBB', true);
+ define('IN_INSTALL', true);
+
++define('PHPBB_ROOT_PATH', '/usr/share/phpbb3/www/');
++
+ $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../';
+ $phpEx = substr(strrchr(__FILE__, '.'), 1);
+
+--- a/install/index.php
++++ b/install/index.php
+@@ -15,6 +15,8 @@
+ define('IN_INSTALL', true);
+ /**#@-*/
+
++define('PHPBB_ROOT_PATH', '/usr/share/phpbb3/www/');
++
+ $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../';
+ $phpEx = substr(strrchr(__FILE__, '.'), 1);
+
+@@ -191,8 +193,8 @@
+ 'load_tplcompile' => '1'
+ );
+
+-$template->set_custom_template('../adm/style', 'admin');
+-$template->assign_var('T_TEMPLATE_PATH', '../adm/style');
++$template->set_custom_template('/usr/share/phpbb3/www/adm/style', 'admin');
++$template->assign_var('T_TEMPLATE_PATH', '/usr/share/phpbb3/www/adm/style');
+
+ // the acp template is never stored in the database
+ $user->theme['template_storedb'] = false;
diff --git a/debian/patches/add_phpbb_prefix_to_ldap_escape.patch b/debian/patches/add_phpbb_prefix_to_ldap_escape.patch
new file mode 100644
index 0000000..51abc2d
--- /dev/null
+++ b/debian/patches/add_phpbb_prefix_to_ldap_escape.patch
@@ -0,0 +1,31 @@
+Description: Add phpbb_ prefix to ldap_escape()
+ Since ldap_escape() has been added to PHP 5.6.0+, it’s internal
+ declaration throws a fatal error:
+ Cannot redeclare ldap_escape() at line 300 in /includes/auth/auth_ldap.php
+Author: Jakub Senko <jakubsenko@gmail.com>
+Origin: upstream
+Bug: https://tracker.phpbb.com/browse/PHPBB3-12468 https://tracker.phpbb.com/browse/PHPBB3-13168
+Bug-Debian: https://bugs.debian.org/778553
+Applied-Upstream: commit, https://github.com/phpbb/phpbb/commit/ba464ec93a2707b602d212e364905a920b3b9460
+Reviewed-by: Andreas Fischer <bantu@phpbb.com>
+Last-Update: 2015-02-16
+--- a/includes/auth/auth_ldap.php
++++ b/includes/auth/auth_ldap.php
+@@ -282,7 +282,7 @@
+ {
+ global $config;
+
+- $filter = '(' . $config['ldap_uid'] . '=' . ldap_escape(htmlspecialchars_decode($username)) . ')';
++ $filter = '(' . $config['ldap_uid'] . '=' . phpbb_ldap_escape(htmlspecialchars_decode($username)) . ')';
+ if ($config['ldap_user_filter'])
+ {
+ $_filter = ($config['ldap_user_filter'][0] == '(' && substr($config['ldap_user_filter'], -1) == ')') ? $config['ldap_user_filter'] : "({$config['ldap_user_filter']})";
+@@ -294,7 +294,7 @@
+ /**
+ * Escapes an LDAP AttributeValue
+ */
+-function ldap_escape($string)
++function phpbb_ldap_escape($string)
+ {
+ return str_replace(array('*', '\\', '(', ')'), array('\\*', '\\\\', '\\(', '\\)'), $string);
+ }
diff --git a/debian/patches/fix_CVE-2015-1431.patch b/debian/patches/fix_CVE-2015-1431.patch
new file mode 100644
index 0000000..3153ad3
--- /dev/null
+++ b/debian/patches/fix_CVE-2015-1431.patch
@@ -0,0 +1,70 @@
+Description: Explicitly disallow trailing paths
+ CSRF potentially allowing an attacker to modify the private message
+ setting that determines how full folders are handled (i.e. whether to
+ delete the oldest message or hold the new message until further space
+ is available).
+ [CVE-2015-1432]
+Author: Marc Alexander <admin@m-a-styles.de>
+Origin: upstream, https://www.phpbb.com/community/viewtopic.php?f=14&t=2291456
+Bug: https://tracker.phpbb.com/browse/PHPBB3-13531, https://tracker.phpbb.com/browse/PHPBB3-13549
+Bug-Debian: https://bugs.debian.org/776699
+Applied-Upstream: commit, https://github.com/phpbb/phpbb/commit/4b9434bf1ba4c015da11309602cfccf1a9c2493c https://github.com/phpbb/phpbb/commit/e34b92882a51dc89da88464b8c751a9d93a03124 https://github.com/phpbb/phpbb/commit/74950559074d738733ac1258b07912f9ca14203a
+Reviewed-by: Andreas Fischer <bantu@phpbb.com>, Nils Adermann <naderman@naderman.de>
+Last-Update: 2015-02-01
+--- a/includes/startup.php
++++ b/includes/startup.php
+@@ -113,6 +113,54 @@
+ unset($input);
+ }
+
++/**
++ * Check if requested page uses a trailing path
++ *
++ * @param string $phpEx PHP extension
++ *
++ * @return bool True if trailing path is used, false if not
++ */
++function phpbb_has_trailing_path($phpEx)
++{
++ // Check if path_info is being used
++ if (!empty($_SERVER['PATH_INFO']) || (!empty($_SERVER['ORIG_PATH_INFO']) && $_SERVER['SCRIPT_NAME'] != $_SERVER['ORIG_PATH_INFO']))
++ {
++ return true;
++ }
++
++ // Match any trailing path appended to a php script in the REQUEST_URI.
++ // It is assumed that only actual PHP scripts use names like foo.php. Due
++ // to this, any phpBB board inside a directory that has the php extension
++ // appended to its name will stop working, i.e. if the board is at
++ // example.com/phpBB/test.php/ or example.com/test.php/
++ if (preg_match('#^[^?]+\.' . preg_quote($phpEx, '#') . '/#', $_SERVER['REQUEST_URI']))
++ {
++ return true;
++ }
++
++ return false;
++}
++
++// Check if trailing path is used
++if (phpbb_has_trailing_path($phpEx))
++{
++ if (substr(strtolower(@php_sapi_name()), 0, 3) === 'cgi')
++ {
++ $prefix = 'Status:';
++ }
++ else if (!empty($_SERVER['SERVER_PROTOCOL']))
++ {
++ $prefix = $_SERVER['SERVER_PROTOCOL'];
++ }
++ else
++ {
++ $prefix = 'HTTP/1.0';
++ }
++ header("$prefix 404 Not Found", true, 404);
++ echo 'Trailing paths and PATH_INFO is not supported by phpBB 3.0';
++ exit;
++}
++
+ // Register globals and magic quotes have been dropped in PHP 5.4
+ if (version_compare(PHP_VERSION, '5.4.0-dev', '>='))
+ {
diff --git a/debian/patches/fix_CVE-2015-1432.patch b/debian/patches/fix_CVE-2015-1432.patch
new file mode 100644
index 0000000..07a9592
--- /dev/null
+++ b/debian/patches/fix_CVE-2015-1432.patch
@@ -0,0 +1,27 @@
+Description: Correctly validate the ucp_pm_options form key
+ This allows an attacker to load arbitrary CSS in Internet Explorer by
+ crafting a URL with trailing paths after a PHP file (for example
+ /path/index.php/more/path). This is only possible if the webserver
+ configuration allows accessing PHP files in this manner.
+Author: Joas Schilling <nickvergessen@gmx.de>
+Origin: upstream, https://www.phpbb.com/community/viewtopic.php?f=14&t=2291456
+Bug: https://tracker.phpbb.com/browse/PHPBB3-13526
+Bug-Debian: https://bugs.debian.org/776699
+Applied-Upstream: commit, https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449
+Reviewed-by: Andreas Fischer <bantu@phpbb.com>
+Last-Update: 2015-02-01
+--- a/includes/ucp/ucp_pm_options.php
++++ b/includes/ucp/ucp_pm_options.php
+@@ -29,7 +29,11 @@
+ // Change "full folder" setting - what to do if folder is full
+ if (isset($_POST['fullfolder']))
+ {
+- check_form_key('ucp_pm_options', $config['form_token_lifetime'], $redirect_url);
++ if (!check_form_key('ucp_pm_options'))
++ {
++ trigger_error('FORM_INVALID');
++ }
++
+ $full_action = request_var('full_action', 0);
+
+ $set_folder_id = 0;
diff --git a/debian/patches/fix_CVE-2015-3880.patch b/debian/patches/fix_CVE-2015-3880.patch
new file mode 100644
index 0000000..320d589
--- /dev/null
+++ b/debian/patches/fix_CVE-2015-3880.patch
@@ -0,0 +1,32 @@
+Description: Fix possible redirection on Chrome
+ An insufficient check allowed users of the Google Chrome browser to be
+ redirected to external domains (e.g. on login).
+ [CVE-2015-3880]
+Author: Marc Alexander <admin@m-a-styles.de>, Joas Schilling <nickvergessen@gmx.de>
+Origin: upstream, https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04
+Reviewed-by: Andreas Fischer <bantu@phpbb.com>
+Last-Update: 2015-05-09
+--- a/includes/functions.php
++++ b/includes/functions.php
+@@ -2492,7 +2492,7 @@
+ // Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work)
+ if (!$disable_cd_check && $url_parts['host'] !== $user->host)
+ {
+- $url = generate_board_url();
++ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
+ }
+ }
+ else if ($url[0] == '/')
+@@ -2579,6 +2579,12 @@
+ }
+ }
+
++ // Make sure we don't redirect to external URLs
++ if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0)
++ {
++ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
++ }
++
+ // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
+ if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
+ {
diff --git a/debian/patches/fix_chown.patch b/debian/patches/fix_chown.patch
new file mode 100644
index 0000000..31b82e2
--- /dev/null
+++ b/debian/patches/fix_chown.patch
@@ -0,0 +1,43 @@
+Description: Fix chown in cache
+ Ensure files in cache belong to www-data. phpBB tries to set them to
+ the same owner than common.php, that belongs to root under Debian, and
+ then set them world writable because it can’t change the owner (nor
+ group) to root.
+Author: David Prévot <taffit@debian.org>
+Bug-Debian: http://bugs.debian.org/711172
+Forwarded: not-needed
+Last-Update: 2013-09-28
+--- a/includes/functions.php
++++ b/includes/functions.php
+@@ -725,16 +725,16 @@
+ {
+ global $phpbb_root_path, $phpEx;
+
+- // Determine owner/group of common.php file and the filename we want to change here
+- $common_php_owner = @fileowner($phpbb_root_path . 'common.' . $phpEx);
+- $common_php_group = @filegroup($phpbb_root_path . 'common.' . $phpEx);
++ // Determine owner/group of the filename we want to change here
++ $common_php_owner = (function_exists('posix_getpwnam')) ? @posix_getpwnam('www-data') : false;
++ $common_php_group = (function_exists('posix_getgrnam')) ? @posix_getgrnam('www-data') : false;
+
+ // And the owner and the groups PHP is running under.
+ $php_uid = (function_exists('posix_getuid')) ? @posix_getuid() : false;
+ $php_gids = (function_exists('posix_getgroups')) ? @posix_getgroups() : false;
+
+ // If we are unable to get owner/group, then do not try to set them by guessing
+- if (!$php_uid || empty($php_gids) || !$common_php_owner || !$common_php_group)
++ if (!$php_uid || empty($php_gids) || empty($common_php_owner) || empty($common_php_group))
+ {
+ $_chmod_info['process'] = false;
+ }
+@@ -742,8 +742,8 @@
+ {
+ $_chmod_info = array(
+ 'process' => true,
+- 'common_owner' => $common_php_owner,
+- 'common_group' => $common_php_group,
++ 'common_owner' => $common_php_owner[uid],
++ 'common_group' => $common_php_group[gid],
+ 'php_uid' => $php_uid,
+ 'php_gids' => $php_gids,
+ );
diff --git a/debian/patches/improve_php_5.6_compatibility.patch b/debian/patches/improve_php_5.6_compatibility.patch
new file mode 100644
index 0000000..67f44e8
--- /dev/null
+++ b/debian/patches/improve_php_5.6_compatibility.patch
@@ -0,0 +1,45 @@
+Description: Handle mbstring.http_{in,out}put for PHP 5.6
+ Having mbstring.http_input set to '' is as good as 'pass'.
+ Fix mbstring warnings in ACP for PHP 5.6 compatibility.
+Author: Andreas Fischer <bantu@phpbb.com>, Oliver Schramm <oliver.schramm97@gmail.com>
+Origin: upstream
+Bug: https://tracker.phpbb.com/browse/PHPBB3-12468 https://tracker.phpbb.com/browse/PHPBB3-13168
+Applied-Upstream: commit, https://github.com/phpbb/phpbb/commit/370015c1a5f490a7fae85da268b81cb8d1748f50 https://github.com/phpbb/phpbb/commit/53f166274aaa55b98a1c671dbb5cbd403d879157
+Reviewed-by: Nils Adermann <naderman@naderman.de>
+Last-Update: 2015-02-02
+--- a/includes/acp/acp_main.php
++++ b/includes/acp/acp_main.php
+@@ -610,8 +610,8 @@
+ 'S_MBSTRING_LOADED' => true,
+ 'S_MBSTRING_FUNC_OVERLOAD_FAIL' => (intval(@ini_get('mbstring.func_overload')) & (MB_OVERLOAD_MAIL | MB_OVERLOAD_STRING)),
+ 'S_MBSTRING_ENCODING_TRANSLATION_FAIL' => (@ini_get('mbstring.encoding_translation') != 0),
+- 'S_MBSTRING_HTTP_INPUT_FAIL' => (@ini_get('mbstring.http_input') != 'pass'),
+- 'S_MBSTRING_HTTP_OUTPUT_FAIL' => (@ini_get('mbstring.http_output') != 'pass'),
++ 'S_MBSTRING_HTTP_INPUT_FAIL' => !in_array(@ini_get('mbstring.http_input'), array('pass', '')),
++ 'S_MBSTRING_HTTP_OUTPUT_FAIL' => !in_array(@ini_get('mbstring.http_output'), array('pass', '')),
+ ));
+ }
+
+--- a/install/install_install.php
++++ b/install/install_install.php
+@@ -273,8 +273,8 @@
+ $checks = array(
+ array('func_overload', '&', MB_OVERLOAD_MAIL|MB_OVERLOAD_STRING),
+ array('encoding_translation', '!=', 0),
+- array('http_input', '!=', 'pass'),
+- array('http_output', '!=', 'pass')
++ array('http_input', '!=', array('pass', '')),
++ array('http_output', '!=', array('pass', ''))
+ );
+
+ foreach ($checks as $mb_checks)
+@@ -295,7 +295,8 @@
+ break;
+
+ case '!=':
+- if ($ini_val != $mb_checks[2])
++ if (!is_array($mb_checks[2]) && $ini_val != $mb_checks[2] ||
++ is_array($mb_checks[2]) && !in_array($ini_val, $mb_checks[2]))
+ {
+ $result = '<strong style="color:red">' . $lang['NO'] . '</strong>';
+ $passed['mbstring'] = false;
diff --git a/debian/patches/privacy-breach-generic.patch b/debian/patches/privacy-breach-generic.patch
new file mode 100644
index 0000000..957da85
--- /dev/null
+++ b/debian/patches/privacy-breach-generic.patch
@@ -0,0 +1,27 @@
+Description: Do not fetch data from an external website
+ Even if the page is not supposed to be displayed, linking to an
+ external CSS is bad taste.
+Author: David Prévot <taffit@debian.org>
+Last-Update: 2014-04-11
+--- a/l10n-pl/language/pl/email/index.htm
++++ /dev/null
+@@ -1,19 +0,0 @@
+-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl">
+- <head>
+- <title>phpBB3pl r210</title>
+- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+- <link rel="stylesheet" type="text/css" href="http://phpbb3.pl/styles/prorange/standalone.css"/>
+- </head>
+- <body>
+- <div id="top">
+- <div class="inner">
+- <h1>phpBB3pl r210</h1>
+- <p class="by">by <a href="http://phpbb3.pl">phpBB3.PL Group</a></p>
+- </div>
+- </div>
+- <div class="section">
+- <p>Copyright © 2006 - 2011 <a href="http://phpbb3.pl">phpBB3.PL Group</a>. Released under <a href="http://opensource.org/licenses/gpl-license.php">GNU General Public License, version 2.0</a>. <a href="ftp://ftp.phpbb3.pl/phpBB/3.0/phpBB3pl/latest/">Download/Pobierz</a>.</p>
+- </div>
+- </body>
+-</html>
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..f3998ad
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,12 @@
+011_fix_version_display.patch
+012_disable_version_check.patch
+021_multisite.patch
+022_multisite_installer.patch
+031_fix_installer.patch
+fix_chown.patch
+privacy-breach-generic.patch
+fix_CVE-2015-1431.patch
+fix_CVE-2015-1432.patch
+improve_php_5.6_compatibility.patch
+add_phpbb_prefix_to_ldap_escape.patch
+fix_CVE-2015-3880.patch
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 04:14:32 +0000