| 1 |
tester 09/08/31 16:09:30 |
| 2 |
|
| 3 |
Added: pidgin-2.5.9-xmpp-old-ssl.patch |
| 4 |
Log: |
| 5 |
Fix security bug #283324, importing patch from 2.6.1. Remove old version |
| 6 |
(Portage version: 2.1.6.13/cvs/Linux x86_64) |
| 7 |
|
| 8 |
Revision Changes Path |
| 9 |
1.1 net-im/pidgin/files/pidgin-2.5.9-xmpp-old-ssl.patch |
| 10 |
|
| 11 |
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-im/pidgin/files/pidgin-2.5.9-xmpp-old-ssl.patch?rev=1.1&view=markup |
| 12 |
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-im/pidgin/files/pidgin-2.5.9-xmpp-old-ssl.patch?rev=1.1&content-type=text/plain |
| 13 |
|
| 14 |
Index: pidgin-2.5.9-xmpp-old-ssl.patch |
| 15 |
=================================================================== |
| 16 |
--- libpurple/protocols/jabber/auth.c.orig 2009-06-25 19:25:47.000000000 -0400 |
| 17 |
+++ libpurple/protocols/jabber/auth.c 2009-08-31 12:01:12.000000000 -0400 |
| 18 |
@@ -691,6 +691,18 @@ |
| 19 |
JabberIq *iq; |
| 20 |
xmlnode *query, *username; |
| 21 |
|
| 22 |
+ /* We can end up here without encryption if the server doesn't support |
| 23 |
+ * <stream:features/> and we're not using old-style SSL. If the user |
| 24 |
+ * is requiring SSL/TLS, we need to enforce it. |
| 25 |
+ */ |
| 26 |
+ if (!js->gsc && |
| 27 |
+ purple_account_get_bool(purple_connection_get_account(js->gc), "require_tls", FALSE)) { |
| 28 |
+ purple_connection_error_reason (js->gc, |
| 29 |
+ PURPLE_CONNECTION_ERROR_ENCRYPTION_ERROR, |
| 30 |
+ _("You require encryption, but it is not available on this server.")); |
| 31 |
+ return; |
| 32 |
+ } |
| 33 |
+ |
| 34 |
#ifdef HAVE_CYRUS_SASL |
| 35 |
/* If we have Cyrus SASL, then passwords will have been set |
| 36 |
* to OPTIONAL for this protocol. So, we need to do our own |
Archives