Cross site scripting in HTML filter

The pbuilder was successful and the patch applied

upstream advisory
http://www.squirrelmail.org/security/issue/2007-05-09

For Gutsy, we can probably just wait for 1.4.10 to get packaged an sync from Debian.

Note that squirrelmail issued an updated patch to deal with a regression, so we should understand that before publishing the fix.

pbuilder was succeful and the regression patch applied

Looks good to me. Confirmed the patch has been modified successfully for the regression fix.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 11 May 2007 18:39:34 -0600
Source: squirrelmail
Binary: squirrelmail
Architecture: source
Version: 2:1.4.9a-1ubuntu0.1
Distribution: feisty-security
Urgency: low
Maintainer: Jeroen van Wolffelaar <email address hidden>
Changed-By: leonel <email address hidden>
Description:
 squirrelmail - Webmail for nuts
Launchpad-Bugs-Fixed: 113725
Changes:
 squirrelmail (2:1.4.9a-1ubuntu0.1) feisty-security; urgency=low
 .
   [SECURITY]
   * functions/mime.php,
     src/compose.php,
     src/view_text.php:
     - Validate input to resolve XSS in HTML filter
     - Updated to fix regression in initial patch
     LP: #113725.
   * References:
     CVE-2007-1262
     http://www.squirrelmail.org/security/issue/2007-05-09
Files:
 5fd84cf7801aa82321b15f5702c973a6 739 web optional squirrelmail_1.4.9a-1ubuntu0.
1.dsc
 c494e3a735f99c07360552d68d35fc62 23563 web optional squirrelmail_1.4.9a-1ubuntu
0.1.diff.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGRRaye9GwFciKvaMRAgwgAJ9QsdTduNEL5DzaNbzzc8j4TrDDEwCdFuES
r4GZYgU99kmCJBXWomLEgts=
=YRM/
-----END PGP SIGNATURE-----

I am confused by the attachments. :) Which is the "correct" version? "regression-fix" or "html-filter" ?

Debian's version (2:1.4.10a-1) has this fixed now.

It's the last attachment. I can't tell you which one it is because the new
LP hmi doesn't work on my Treo.

It's the last attachment it has the html-filter patch and the regression patch

the first 2 attachments where done by editing debian/rules
the last attachment does not have debian/rules edited

this is for edgy
pbuilder was successful and patch applied
installed and deb tested

Your debdiff looks good, and built fine for me. I adjusted the changelog a little, and I've sponsored the upload. :) I should have it published as soon as it's done building.

this is for dapper

Very cool. Thanks for getting this packaged up and tested. I will have it published as soon as the build is finished. Thank you again!