Add youtu.be to video filters (bug #1017464)

Youtube started giving youtu.be urls in their embed codes since
1.4.0 came out. It was added in 1.5 < but not ported to 1.4.

Change-Id: I210e5957c1678cdb58bcb4b80bb618bf175aa9e2
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Merge "Add youtu.be to video filters (bug #1017464)" into 1.4_STABLE
Json-encode login form when injected by js (bug #1009784)

Change-Id: Ia81053332cfa9e0f79268031795af8d34b45ff78
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>
Patch XSS vulnerability in Insert/Edit Image in Edit blog

Change-Id: Ia9df5e4eef4f3fb50ae1464540d777522179ac82
Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>
Merge "Json-encode login form when injected by js (bug #1009784)" into 1.4_STABLE
Merge "Patch XSS vulnerability in Insert/Edit Image in Edit blog" into 1.4_STABLE
Sanitize links in links and resources menu (bug #1009774)

Links placed in the links and resources list have not been getting
checked and so have been displayed unfiltered to users and other
admins. These user-supplied links are now checked with sanitize_url
which has been extended to convert relative links to absolute.

Change-Id: I679627c4e33621df82705c39e77e7226ffef5a97
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Merge "Sanitize links in links and resources menu (bug #1009774)" into 1.4_STABLE
Version bump for 1.4.3

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Version bump for 1.4.4testing

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Fix XML Security bug

Change-Id: If2c9df36670aaae597470d0b640b4b58b2fb12e6
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Merge "Fix XML Security bug" into 1.4_STABLE
Version bump for 1.4.4

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Version bump for 1.4.5testing

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Remove clamav from site admin options

Bug #1057238
CVE-2012-2244

When a site administrator can manipulate the path for the
clamav scanner, they could produce either a reverse shell,
or allow any user to execute arbitrary remote commands by
setting it to an uploaded reverse shell, or to /bin/bash
respectively.

Other executable paths, namely pathtozip, and pathtounzip
are only set via config.php, and not through the site admin
interface. This option, pathtoclam, should follow the same
design.

Change-Id: I7d4822c9f54eda80682d6631699c1ab40f1dc896
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Fix saved file permissions

Bug #1057238
CVE-2012-2244

Currently, files that are saved by Mahara use the
directorypermissions config option, which defaults to
0700, which allows execution.

This allows users to potentially upload files with
executable bits set, and if they have control of the
config options pathtoclam, pathtozip, or pathtounzip
then they could run this command when one of those
commands are invocated.

This patch bitwise-AND's the directory permissions
config with 0666, which removes any executable bit
and sets the result as a new config option
filepermissions.

A change the upload code to use this new option is made

Change-Id: I088d9873de7797d5a9aefc2401301f8b855ed592
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Escape user uploaded XHTML files

Bug #1055232
CVE-2012-2243

Before this patch, if a user uploaded HTML or XML files
then tried to download them, or linked other users to download
them, they would be presented with an escaped version along
with a link to download the original.

This did not include XHTML files, which can cause the same
security issues as HTML or XML files. This patch includes the
XHTML mimetype of application/xhtml+xml in the test of which
files to escape.

Change-Id: Iffb8308fdb56a173fd4af2bbda800999dd11fea3
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Fix up old file permissions to remove executable

Bug #1057238
CVE-2012-2244

In previous versions of mahara, all the user uploaded files
had the executable bit set. This patch runs an upgrade script
to remove this executable bit.

Change-Id: If4a3f5876f34bd2d38ff9edcd96b234271c2d1f6
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Fix Click-Jacking attack on account deletion page

This attack has been mitigated by adding a HTTP header
of X-Frame-Options to every page in Mahara.

Bug #1057240
CVE-2012-2246

Change-Id: Ia15bb43c83054ffa5540d71fcc932266b92d288f
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Escape user uploaded SVG files

Bug #1061980
CVE-2012-2247

Before this patch, if a user uploaded HTML or XML files
then tried to download them, or linked other users to download
them, they would be presented with an escaped version along
with a link to download the original.

Unfortunately, an SVG file can possibly contain unsecure content,
such as javascript, that would be run on the victims browser.

This patch adds SVG files (image/svg+xml) to the list of files
to not display by default.

Change-Id: I56e7c9d2a7d8de03b5b3be31f0ac44198547ea09
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>