Security fix for bug #70739.

9 files changed, 59 insertions, 379 deletions

diff --git a/mail-client/squirrelmail/ChangeLog b/mail-client/squirrelmail/ChangeLog
index 8a9a49c1933e..4824a38cc244 100644
--- a/mail-client/squirrelmail/ChangeLog
+++ b/mail-client/squirrelmail/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for mail-client/squirrelmail
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/mail-client/squirrelmail/ChangeLog,v 1.11 2004/07/17 22:08:37 aliz Exp $
+# $Header: /var/cvsroot/gentoo-x86/mail-client/squirrelmail/ChangeLog,v 1.12 2004/11/11 08:31:39 eradicator Exp $
+
+*squirrelmail-1.4.3a-r2 (11 Nov 2004)
+
+  11 Nov 2004; Jeremy Huddleston <eradicator@gentoo.org>
+  +files/squirrelmail-1.4.3a-xss.patch, -squirrelmail-1.4.3_rc1-r1.ebuild,
+  -squirrelmail-1.4.3_rc1.ebuild, -squirrelmail-1.4.3a-r1.ebuild,
+  +squirrelmail-1.4.3a-r2.ebuild:
+  Security fix for bug #70739.
 
   14 Jun 2004; Luca Barbato <lu_zero@gentoo.org> squirrelmail-1.4.3a.ebuild:
   Marked ppc
diff --git a/mail-client/squirrelmail/Manifest b/mail-client/squirrelmail/Manifest
index 7b14482d374f..1a7797e2e593 100644
--- a/mail-client/squirrelmail/Manifest
+++ b/mail-client/squirrelmail/Manifest
@@ -1,13 +1,20 @@
-MD5 9ce1f514f4f4f584d38ca79c2d99ae39 squirrelmail-1.4.3a.ebuild 5038
-MD5 36e6067fdc99e0162fec591902da97d7 squirrelmail-1.4.3a-r1.ebuild 5340
-MD5 879630b20a6f28e8d19eff33ee77d4ce squirrelmail-1.4.3_rc1.ebuild 5041
-MD5 85de7164991d304f4725d44723186dbb ChangeLog 10322
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 MD5 08cd5d6f4b8f101029a526ea0a1ea4b1 metadata.xml 258
-MD5 b7d982053714f892b659790e0e60e36a squirrelmail-1.4.3_rc1-r1.ebuild 5343
-MD5 ebb6924dba63e16023a37f0f4f5563e8 files/squirrelmail-fortune.patch 603
-MD5 a34a9335bafb3173bb60b373caae8c4e files/postinstall-en.txt 698
+MD5 d5d64a3df4efe94f055d1f7bb9f7cff2 ChangeLog 10631
+MD5 9ce1f514f4f4f584d38ca79c2d99ae39 squirrelmail-1.4.3a.ebuild 5038
+MD5 86352716fdd1319cd03a5d8dd76e37c1 squirrelmail-1.4.3a-r2.ebuild 5398
+MD5 3ba374a5c4f5e7a0f7c64b9f9ba000ae files/digest-squirrelmail-1.4.3a-r2 636
 MD5 3ba374a5c4f5e7a0f7c64b9f9ba000ae files/digest-squirrelmail-1.4.3a 636
-MD5 3ba374a5c4f5e7a0f7c64b9f9ba000ae files/digest-squirrelmail-1.4.3a-r1 636
-MD5 19099cd147d6281aad79ea067c5ed4fd files/digest-squirrelmail-1.4.3_rc1 639
 MD5 1ebd5ce3ff0ce02fa62f3890b6a8f255 files/ldapuserdata-0.4-gentoo.patch 709
-MD5 19099cd147d6281aad79ea067c5ed4fd files/digest-squirrelmail-1.4.3_rc1-r1 639
+MD5 a34a9335bafb3173bb60b373caae8c4e files/postinstall-en.txt 698
+MD5 ebb6924dba63e16023a37f0f4f5563e8 files/squirrelmail-fortune.patch 603
+MD5 f4c0fcd6d4349e312d335f82e4485f6c files/squirrelmail-1.4.3a-xss.patch 1025
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.2.6 (GNU/Linux)
+
+iD8DBQFBkyPJArHZZzCEUG0RAqEVAJ4qxdDDTTlud1G96vVii7X23AzlgwCeMLIE
+u35vlCLZ0DpsFfJ/J3wB9OM=
+=Vzef
+-----END PGP SIGNATURE-----
diff --git a/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3_rc1 b/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3_rc1
deleted file mode 100644
index c86a8c4e0913..000000000000
--- a/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3_rc1
+++ /dev/null
@@ -1,9 +0,0 @@
-MD5 5c02d4f11c984b9354f0f02ccbecae2e squirrelmail-1.4.3-RC1.tar.bz2 2248976
-MD5 dfe469f7ab473fd2292b30800e3141d5 retrieveuserdata.0.9-1.4.0.tar.gz 10448
-MD5 049c46507ef161ad4ba5f4d4a0b96d09 compatibility-1.3.tar.gz 5966
-MD5 73d2c111579e2fad17c289f62e0be855 secure_login-1.2-1.2.8.tar.gz 6361
-MD5 a14a46388ed710a81c356d69276844c1 show_ssl_link-2.1-1.2.8.tar.gz 5950
-MD5 c321d0f7efa624f6bc3f3a4d1bf08782 admin_add.0.1-1.4.0.tar.gz 2388
-MD5 e68481acab96c17f02cb397762d8959e virus_scan.0.5-1.4.0.tar.gz 25179
-MD5 88f80922e2a060f5277fd2192404efab gpg.2.0.1-1.4.2.tar.gz 383592
-MD5 c836661e8360358b94df4e153e449b2c ldapuserdata-0.4.tar.gz 67439
diff --git a/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3_rc1-r1 b/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3_rc1-r1
deleted file mode 100644
index c86a8c4e0913..000000000000
--- a/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3_rc1-r1
+++ /dev/null
@@ -1,9 +0,0 @@
-MD5 5c02d4f11c984b9354f0f02ccbecae2e squirrelmail-1.4.3-RC1.tar.bz2 2248976
-MD5 dfe469f7ab473fd2292b30800e3141d5 retrieveuserdata.0.9-1.4.0.tar.gz 10448
-MD5 049c46507ef161ad4ba5f4d4a0b96d09 compatibility-1.3.tar.gz 5966
-MD5 73d2c111579e2fad17c289f62e0be855 secure_login-1.2-1.2.8.tar.gz 6361
-MD5 a14a46388ed710a81c356d69276844c1 show_ssl_link-2.1-1.2.8.tar.gz 5950
-MD5 c321d0f7efa624f6bc3f3a4d1bf08782 admin_add.0.1-1.4.0.tar.gz 2388
-MD5 e68481acab96c17f02cb397762d8959e virus_scan.0.5-1.4.0.tar.gz 25179
-MD5 88f80922e2a060f5277fd2192404efab gpg.2.0.1-1.4.2.tar.gz 383592
-MD5 c836661e8360358b94df4e153e449b2c ldapuserdata-0.4.tar.gz 67439
diff --git a/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3a-r1 b/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3a-r2
index a4ebb31682f2..a4ebb31682f2 100644
--- a/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3a-r1
+++ b/mail-client/squirrelmail/files/digest-squirrelmail-1.4.3a-r2
diff --git a/mail-client/squirrelmail/files/squirrelmail-1.4.3a-xss.patch b/mail-client/squirrelmail/files/squirrelmail-1.4.3a-xss.patch
new file mode 100644
index 000000000000..7786892d2f4b
--- /dev/null
+++ b/mail-client/squirrelmail/files/squirrelmail-1.4.3a-xss.patch
@@ -0,0 +1,28 @@
+diff -urN functions/mime.php functions/mime.php
+--- functions/mime.php	2004-05-23 19:14:11.000000000 +0300
++++ functions/mime.php	2004-11-03 19:16:50.000000000 +0200
+@@ -602,13 +602,22 @@
+             }
+             $iLastMatch = $i;
+             $j = $i;
+-            $ret .= $res[1];
++            if ($htmlsave) {
++                $ret .= htmlspecialchars($res[1]);
++            } else {
++                $ret .= $res[1];
++            }
+             $encoding = ucfirst($res[3]);
+             switch ($encoding)
+             {
+             case 'B':
+                 $replace = base64_decode($res[4]);
+-                $ret .= charset_decode($res[2],$replace);
++                if ($utfencode) {
++                    $replace = charset_decode($res[2],$replace);
++                } elseif ($htmlsave) {
++                    $replace = htmlspecialchars($replace);
++                }
++                $ret .= $replace;
+                 break;
+             case 'Q':
+                 $replace = str_replace('_', ' ', $res[4]);
diff --git a/mail-client/squirrelmail/squirrelmail-1.4.3_rc1-r1.ebuild b/mail-client/squirrelmail/squirrelmail-1.4.3_rc1-r1.ebuild
deleted file mode 100644
index dc3d099bf26c..000000000000
--- a/mail-client/squirrelmail/squirrelmail-1.4.3_rc1-r1.ebuild
+++ /dev/null
@@ -1,195 +0,0 @@
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/mail-client/squirrelmail/squirrelmail-1.4.3_rc1-r1.ebuild,v 1.3 2004/07/14 16:33:05 agriffis Exp $
-
-IUSE="crypt ldap ssl virus-scan"
-
-inherit webapp eutils
-
-DESCRIPTION="Webmail for nuts!"
-
-# Plugin Versions
-COMPATIBILITY_VER=1.3
-USERDATA_VER=0.9-1.4.0
-ADMINADD_VER=0.1-1.4.0
-VSCAN_VER=0.5-1.4.0
-GPG_VER=2.0.1-1.4.2
-LDAP_VER=0.4
-SECURELOGIN_VER=1.2-1.2.8
-SHOWSSL_VER=2.1-1.2.8
-
-MY_P=${P/_rc/-RC}
-S="${WORKDIR}/${MY_P}"
-
-PLUGINS_LOC="http://www.squirrelmail.org/plugins"
-SRC_URI="mirror://sourceforge/${PN}/${MY_P}.tar.bz2
-	mirror://sourceforge/retruserdata/retrieveuserdata.${USERDATA_VER}.tar.gz
-	${PLUGINS_LOC}/compatibility-${COMPATIBILITY_VER}.tar.gz
-	ssl? ( ${PLUGINS_LOC}/secure_login-${SECURELOGIN_VER}.tar.gz )
-	ssl? ( ${PLUGINS_LOC}/show_ssl_link-${SHOWSSL_VER}.tar.gz )
-	${PLUGINS_LOC}/admin_add.${ADMINADD_VER}.tar.gz
-	virus-scan? ( ${PLUGINS_LOC}/virus_scan.${VSCAN_VER}.tar.gz )
-	crypt? ( ${PLUGINS_LOC}/gpg.${GPG_VER}.tar.gz )
-	ldap? ( ${PLUGINS_LOC}/ldapuserdata-${LDAP_VER}.tar.gz )"
-
-HOMEPAGE="http://www.squirrelmail.org/"
-
-LICENSE="GPL-2"
-KEYWORDS="~x86 ~ppc ~sparc ~amd64 ~alpha"
-
-DEPEND="virtual/php
-	dev-perl/DB_File
-	crypt? ( app-crypt/gnupg )
-	ldap? ( net-nds/openldap )"
-
-src_unpack() {
-	unpack ${MY_P}.tar.bz2
-
-	cd ${S}
-	mv config/config_default.php config/config.php
-	epatch ${FILESDIR}/${PN}-fortune.patch
-
-	# Now do the plugins
-	cd ${S}/plugins
-
-	unpack compatibility-${COMPATIBILITY_VER}.tar.gz
-
-	unpack admin_add.${ADMINADD_VER}.tar.gz
-
-	unpack retrieveuserdata.${USERDATA_VER}.tar.gz
-
-	use virus-scan &&
-		unpack virus_scan.${VSCAN_VER}.tar.gz &&
-		mv virus_scan/config.php.sample virus_scan/config.php
-
-	use crypt &&
-		unpack gpg.${GPG_VER}.tar.gz
-
-	use ldap &&
-		unpack ldapuserdata-${LDAP_VER}.tar.gz &&
-		epatch ${FILESDIR}/ldapuserdata-${LDAP_VER}-gentoo.patch &&
-		mv ldapuserdata/config_sample.php ldapuserdata/config.php
-
-	use ssl &&
-		unpack secure_login-${SECURELOGIN_VER}.tar.gz &&
-		mv secure_login/config.php.sample secure_login/config.php &&
-		unpack show_ssl_link-${SHOWSSL_VER}.tar.gz &&
-		mv show_ssl_link/config.php.sample show_ssl_link/config.php
-}
-
-src_compile() {
-	#we need to have this empty function ... default compile hangs
-	echo "Nothing to compile"
-}
-
-src_install() {
-	webapp_src_preinst
-
-	# handle documentation files
-	#
-	# NOTE that doc files go into /usr/share/doc as normal; they do NOT
-	# get installed per vhost!
-
-	for doc in AUTHORS COPYING ChangeLog INSTALL README ReleaseNotes UPGRADE; do
-		dodoc ${doc}
-		rm -f ${doc}
-	done
-
-	docinto compatibility
-	for doc in plugins/compatibility/INSTALL plugins/compatibility/README; do
-		dodoc ${doc}
-		rm -f ${doc}
-	done
-
-	docinto admin_add
-	for doc in plugins/admin_add/README; do
-		dodoc ${doc}
-		rm -f ${doc}
-	done
-
-	docinto retrieveuserdata
-	for doc in plugins/retrieveuserdata/INSTALL plugins/retrieveuserdata/changelog plugins/retrieveuserdata/users_example.txt; do
-		dodoc ${doc}
-		rm -f ${doc}
-	done
-
-	if use virus-scan; then
-		docinto virus-scan
-		for doc in plugins/virus_scan/README; do
-			dodoc ${doc}
-			rm -f ${doc}
-		done
-	fi
-
-	if use crypt; then
-		docinto gpg
-		for doc in plugins/gpg/README plugins/gpg/README.txt plugins/gpg/INSTALL plugins/gpg/INSTALL.txt plugins/gpg/TODO; do
-			dodoc ${doc}
-			rm -f ${doc}
-		done
-	fi
-
-	if use ldap; then
-		rm plugins/ldapuserdata/README
-		docinto ldapuserdata
-		for doc in plugins/ldapuserdata/doc/README; do
-			dodoc ${doc}
-			rm -f ${doc}
-		done
-	fi
-
-	if use ssl; then
-		docinto secure_login
-		for doc in plugins/secure_login/INSTALL plugins/secure_login/README; do
-			dodoc ${doc}
-			rm -f ${doc}
-		done
-
-		docinto show_ssl_link
-		for doc in plugins/show_ssl_link/INSTALL plugins/show_ssl_link/README; do
-			dodoc ${doc}
-			rm -f ${doc}
-		done
-	fi
-
-	# Copy the app's main files
-	einfo "Installing squirrelmail files."
-	cp -r . ${D}${MY_HTDOCSDIR}
-
-	# Identify the configuration files that this app uses
-	local configs="config/config.php config/config_local.php plugins/retrieveuserdata/config.php"
-	use virus-scan && configs="${configs} plugins/virus_scan/config.php"
-	use crypt && configs="${configs} plugins/gpg/gpg_local_prefs.txt"
-	use ldap && configs="${configs} plugins/ldapuserdata/config.php"
-	use ssl && configs="${configs} plugins/show_ssl_link/config.php plugins/secure_login/config.php"
-
-	for file in ${configs}; do
-		webapp_configfile ${MY_HTDOCSDIR}/${file}
-	done
-
-	# Identify any script files that need #! headers adding to run under
-	# a CGI script (such as PHP/CGI)
-	#
-	# for phpmyadmin, we *assume* that all .php files that don't end in
-	# .inc.php need to have CGI/BIN support added
-
-	#for x in `find . -name '*.php' -print | grep -v 'inc.php'` ; do
-	#	webapp_runbycgibin php ${MY_HTDOCSDIR}/$x
-	#done
-
-	# virus scanning signatures needs to be owned by the server so it can update them
-	local server_owned="data index.php"
-	use virus-scan && server_owned="${server_owned} plugins/virus_scan/includes/virussignatures.php plugins/virus_scan/config.php"
-	for file in ${server_owned}; do
-		webapp_serverowned ${MY_HTDOCSDIR}/${file}
-	done
-
-	# add the post-installation instructions
-	webapp_postinst_txt en ${FILESDIR}/postinstall-en.txt
-
-	# all done
-	#
-	# now we let the eclass strut its stuff ;-)
-
-	webapp_src_install
-}
diff --git a/mail-client/squirrelmail/squirrelmail-1.4.3_rc1.ebuild b/mail-client/squirrelmail/squirrelmail-1.4.3_rc1.ebuild
deleted file mode 100644
index 428529a66784..000000000000
--- a/mail-client/squirrelmail/squirrelmail-1.4.3_rc1.ebuild
+++ /dev/null
@@ -1,153 +0,0 @@
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/mail-client/squirrelmail/squirrelmail-1.4.3_rc1.ebuild,v 1.3 2004/07/14 16:33:05 agriffis Exp $
-
-inherit webapp-apache eutils
-
-DESCRIPTION="Webmail for nuts!"
-
-# Plugin Versions
-COMPATIBILITY_VER=1.3
-USERDATA_VER=0.9-1.4.0
-ADMINADD_VER=0.1-1.4.0
-VSCAN_VER=0.5-1.4.0
-GPG_VER=2.0.1-1.4.2
-LDAP_VER=0.4
-SECURELOGIN_VER=1.2-1.2.8
-SHOWSSL_VER=2.1-1.2.8
-
-MY_P=${P/_rc/-RC}
-S="${WORKDIR}/${MY_P}"
-
-PLUGINS_LOC="http://www.squirrelmail.org/plugins"
-SRC_URI="mirror://sourceforge/${PN}/${MY_P}.tar.bz2
-	mirror://sourceforge/retruserdata/retrieveuserdata.${USERDATA_VER}.tar.gz
-	${PLUGINS_LOC}/compatibility-${COMPATIBILITY_VER}.tar.gz
-	${PLUGINS_LOC}/secure_login-${SECURELOGIN_VER}.tar.gz
-	${PLUGINS_LOC}/show_ssl_link-${SHOWSSL_VER}.tar.gz
-	${PLUGINS_LOC}/admin_add.${ADMINADD_VER}.tar.gz
-	${PLUGINS_LOC}/virus_scan.${VSCAN_VER}.tar.gz
-	${PLUGINS_LOC}/gpg.${GPG_VER}.tar.gz
-	${PLUGINS_LOC}/ldapuserdata-${LDAP_VER}.tar.gz"
-
-HOMEPAGE="http://www.squirrelmail.org/"
-
-IUSE="crypt ldap ssl virus-scan"
-
-LICENSE="GPL-2"
-SLOT="1"
-KEYWORDS="x86 ppc sparc ~alpha ~amd64"
-
-DEPEND="virtual/php
-	dev-perl/DB_File
-	crypt? ( app-crypt/gnupg )
-	ldap? ( net-nds/openldap )"
-
-pkg_setup() {
-	webapp-detect || NO_WEBSERVER=1
-	webapp-pkg_setup "${NO_WEBSERVER}"
-	if [ -L ${HTTPD_ROOT}/${PN} ] ; then
-		ewarn "You need to unmerge your old SquirrelMail version first."
-		ewarn "SquirrelMail will be installed into ${HTTPD_ROOT}/${PN}"
-		ewarn "directly instead of a version-dependant directory."
-		die "need to unmerge old version first"
-	fi
-	einfo "Installing into ${ROOT}${HTTPD_ROOT}."
-}
-
-src_unpack() {
-	unpack ${MY_P}.tar.bz2
-	cd ${S}
-	epatch ${FILESDIR}/${PN}-fortune.patch
-
-	# Now do the plugins
-	cd ${S}/plugins
-
-	unpack compatibility-${COMPATIBILITY_VER}.tar.gz
-
-	unpack admin_add.${ADMINADD_VER}.tar.gz
-
-	unpack retrieveuserdata.${USERDATA_VER}.tar.gz &&
-		mv retrieveuserdata/config.php retrieveuserdata/config_default.php
-
-	use virus-scan &&
-		unpack virus_scan.${VSCAN_VER}.tar.gz &&
-		mv virus_scan/config.php.sample virus_scan/config_default.php
-
-	use crypt &&
-		unpack gpg.${GPG_VER}.tar.gz &&
-		mv gpg/gpg_local_prefs.txt gpg/gpg_local_prefs_default.txt
-
-	use ldap &&
-		unpack ldapuserdata-${LDAP_VER}.tar.gz &&
-		epatch ${FILESDIR}/ldapuserdata-${LDAP_VER}-gentoo.patch
-
-	use ssl &&
-		unpack secure_login-${SECURELOGIN_VER}.tar.gz &&
-		unpack show_ssl_link-${SHOWSSL_VER}.tar.gz
-}
-
-src_compile() {
-	#we need to have this empty function ... default compile hangs
-	echo "Nothing to compile"
-}
-
-src_install() {
-	webapp-mkdirs
-
-	local DocumentRoot=${HTTPD_ROOT}
-	local destdir=${DocumentRoot}/${PN}
-	dodir ${destdir}
-	cp -r . ${D}/${HTTPD_ROOT}/${PN}
-	cd ${D}/${HTTPD_ROOT}
-	chown -R ${HTTPD_USER}:${HTTPD_GROUP} ${PN}/data
-	# Fix permissions
-	find ${D}${destdir} -type d | xargs chmod 755
-	find ${D}${destdir} -type f | xargs chmod 644
-
-	# Make SquirrelMail configure scripts executable
-	chmod 755 ${D}${destdir}/configure
-	chmod 755 ${D}${destdir}/config/conf.pl
-
-	use virus-scan && chown -R ${HTTPD_USER}:${HTTPD_GROUP} ${PN}/plugins/virus_scan/includes/virussignatures.php ${PN}/plugins/virus_scan/config_default.php
-}
-
-pkg_postinst() {
-	local DocumentRoot=${HTTPD_ROOT}
-	local destdir=${DocumentRoot}/${PN}
-
-	einfo "Now copy these following configuration files to their destinations and"
-	einfo "edit them to configure your settings.  This is not done automatically so"
-	einfo "that your old settings are not disturbed.  For readibility, all files"
-	einfo "are relative to ${destdir}."
-
-	einfo
-	einfo "config/config_default.php -> config/config.php"
-	einfo "plugins/retrieveuserdata/config_default.php -> plugins/retrieveuserdata/config.php"
-	use virus-scan && einfo "plugins/virus_scan/config_default.php -> plugins/virus_scan/config.php"
-	use crypt && einfo  "plugins/gpg/gpg_local_prefs_default.txt -> plugins/gpg/gpg_local_prefs.txt"
-	use ldap && einfo  "plugins/ldapuserdata/config_sample.php -> plugins/ldapuserdata/config.php"
-	use ssl && einfo  "plugins/show_ssl_link/config.php.sample -> plugins/show_ssl_link/config.php"
-	use ssl && einfo  "plugins/secure_login/config.php.sample -> plugins/secure_login/config.php"
-
-	einfo
-	einfo "You should also create the file '${destdir}/config/admins'"
-	einfo "containing the users who should have access to administrative options."
-	einfo "Put each login on its own line, and be sure to leave a newline at the end of the file."
-
-	einfo
-	einfo "You can use the console based configuration tool by executing:"
-	einfo "cd ${destdir}/config; perl conf.pl"
-
-	old_ver=`ls ${HTTPD_ROOT}/${PN}-[0-9]* 2>/dev/null`
-	if [ ! -z "${old_ver}" ]; then
-		einfo ""
-		einfo "You will also want to move old SquirrelMail data to"
-		einfo "the new location:"
-		einfo ""
-		einfo "\tmv ${HTTPD_ROOT}/${PN}-OLDVERSION/data/* \\"
-		einfo "\t\t${HTTPD_ROOT}/${PN}/data"
-		einfo "\tmv ${HTTPD_ROOT}/${PN}-OLDVERSION/config/config.php \\"
-		einfo "\t\t${HTTPD_ROOT}/${PN}/config"
-	fi
-}
diff --git a/mail-client/squirrelmail/squirrelmail-1.4.3a-r1.ebuild b/mail-client/squirrelmail/squirrelmail-1.4.3a-r2.ebuild
index eebbe5da5a87..20f4c5f5f3a6 100644
--- a/mail-client/squirrelmail/squirrelmail-1.4.3a-r1.ebuild
+++ b/mail-client/squirrelmail/squirrelmail-1.4.3a-r2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/mail-client/squirrelmail/squirrelmail-1.4.3a-r1.ebuild,v 1.3 2004/07/14 16:33:05 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/mail-client/squirrelmail/squirrelmail-1.4.3a-r2.ebuild,v 1.1 2004/11/11 08:31:39 eradicator Exp $
 
 IUSE="crypt ldap ssl virus-scan"
 
@@ -35,7 +35,7 @@ SRC_URI="mirror://sourceforge/${PN}/${MY_P}.tar.bz2
 HOMEPAGE="http://www.squirrelmail.org/"
 
 LICENSE="GPL-2"
-KEYWORDS="~x86 ~ppc ~sparc ~amd64 ~alpha"
+KEYWORDS="~alpha amd64 ~ppc sparc x86"
 
 DEPEND="virtual/php
 	dev-perl/DB_File
@@ -49,6 +49,9 @@ src_unpack() {
 	mv config/config_default.php config/config.php
 	epatch ${FILESDIR}/${PN}-fortune.patch
 
+	# Security bug #70739
+	epatch ${FILESDIR}/${P}-xss.patch
+
 	# Now do the plugins
 	cd ${S}/plugins