Update ktorrent package to 2.2.8 and fix internal geoip database.

This resolves bug report 363.

ChangeLog

@@ -1,3 +1,11 @@
+Changes in 2.2.8 :
+- Backported some security fixes for the webinterface from KDE4 version
+
+Changes in 2.2.7 :
+- Fix crash when loading articles in RSS plugin fails (161475)
+- Fix SIGBUS caused crash on sparc
+- Backported fix from KDE4 version for an infinite recursive loop in the QM
+
 Changes in 2.2.6 :
 - Some OpenBSD compile fixes
 - Fix lock file not working on NFS home directories by moving it to /tmp

Makefile.am

@@ -1,4 +1,4 @@
-SUBDIRS = translations libktorrent plugins apps scripts
+SUBDIRS = libktorrent plugins apps scripts translations
 
 # $(UTESTS_DIR)
 

acinclude.m4

@@ -4649,18 +4649,20 @@ fi
 
 AC_DEFUN([KDE_CHECK_PYTHON],
 [
-  KDE_CHECK_PYTHON_INTERN("2.5",
-    [KDE_CHECK_PYTHON_INTERN("2.4",
-     [KDE_CHECK_PYTHON_INTERN("2.3", 
-       [KDE_CHECK_PYTHON_INTERN("2.2", 
-         [KDE_CHECK_PYTHON_INTERN("2.1", 
-           [KDE_CHECK_PYTHON_INTERN("2.0", 
-             [KDE_CHECK_PYTHON_INTERN($1, $2) ])
-           ])
-         ])
-       ])
-     ])
-  ])
+  KDE_CHECK_PYTHON_INTERN("2.6",
+    [KDE_CHECK_PYTHON_INTERN("2.5",
+      [KDE_CHECK_PYTHON_INTERN("2.4",
+        [KDE_CHECK_PYTHON_INTERN("2.3", 
+          [KDE_CHECK_PYTHON_INTERN("2.2", 
+            [KDE_CHECK_PYTHON_INTERN("2.1", 
+              [KDE_CHECK_PYTHON_INTERN("2.0", 
+                [KDE_CHECK_PYTHON_INTERN($1, $2) ])
+              ])
+            ])
+          ])
+        ])
+      ])
+    ])
 ])
 
 AC_DEFUN([KDE_CHECK_STL],

configure.in

@@ -40,7 +40,7 @@ dnl Perform program name transformation
 AC_ARG_PROGRAM
 
 dnl Automake doc recommends to do this only here. (Janos)
-AM_INIT_AUTOMAKE(ktorrent, 2.2.6) dnl searches for some needed programs
+AM_INIT_AUTOMAKE(ktorrent, 2.2.8) dnl searches for some needed programs
 
 KDE_SET_PREFIX
 

configure.in.in

@@ -1,6 +1,6 @@
 #MIN_CONFIG(3.3)
 
-AM_INIT_AUTOMAKE(ktorrent,2.2.6)
+AM_INIT_AUTOMAKE(ktorrent,2.2.8)
 
 dnl #### Check for FSEEK variants
 AC_SYS_LARGEFILE

libktorrent/ktversion.h

@@ -27,10 +27,10 @@ namespace kt
 {
 	const bt::Uint32 MAJOR = 2;
 	const bt::Uint32 MINOR = 2;
-	const char VERSION_STRING[] = "2.2.6";
-	const char PEER_ID[] = "-KT2260-";
+	const char VERSION_STRING[] = "2.2.8";
+	const char PEER_ID[] = "-KT2280-";
 }
 
-#define KT_VERSION_MACRO "2.2.6"
+#define KT_VERSION_MACRO "2.2.8"
 
 #endif

libktorrent/torrent/queuemanager.cpp

@@ -49,6 +49,7 @@ namespace bt
 
 		keep_seeding = true; //test. Will be passed from Core
 		paused_state = false;
+		ordering = false;
 	}
 
 
@@ -439,11 +440,13 @@ namespace bt
 
 	void QueueManager::orderQueue()
 	{
-		if (!downloads.count())
+		if (!downloads.count() || ordering)
 			return;
 
 		if (paused_state || exiting)
 			return;
+		
+		ordering = true;
 
 		downloads.sort();
 
@@ -584,7 +587,7 @@ namespace bt
 				}
 			}
 		}
-
+		ordering = false;
 	}
 
 	void QueueManager::torrentFinished(kt::TorrentInterface* tc)

libktorrent/torrent/queuemanager.h

@@ -169,6 +169,7 @@ namespace bt
 			bool paused_state;
 			bool keep_seeding;
 			bool exiting;
+			bool ordering;
 	};
 }
 #endif

libktorrent/util/sha1hashgen.cpp

@@ -139,12 +139,11 @@ namespace bt
 		{
 			if (i < 16)
 			{
-				w[i] = ntohl(*(const Uint32*)(chunk + (4*i)));
-			/*	w[i] = (chunk[4*i] << 24) | 
+			//	w[i] = ntohl(*(const Uint32*)(chunk + (4*i))); <- crashes on sparc
+				w[i] = (chunk[4*i] << 24) | 
 						(chunk[4*i + 1] << 16) | 
 						(chunk[4*i + 2] << 8) | 
 						chunk[4*i + 3];
-				*/
 			}
 			else
 			{

plugins/rssfeed/rssfeed.cpp

@@ -195,11 +195,18 @@ namespace kt
 		
 		if (file.exists())
 			{
-			file.open( IO_ReadOnly );
+			try
+				{
+				file.open( IO_ReadOnly );
 			TQDataStream in(&file);
 			
-			in >> m_articles;
-			emit articlesChanged( m_articles );
+				in >> m_articles;
+				emit articlesChanged( m_articles );
+				}
+			catch (...)
+				{
+				m_articles.clear();
+				}
 			}
 	}
 	

plugins/stats/ChartDrawer.h

@@ -23,6 +23,8 @@
 
 #include <stdint.h> 
 
+#include <stdint.h> //uint32_t, int64_t
+
 #include <tqwidget.h>
 #include <tqpainter.h>
 #include <tqstring.h>

plugins/webinterface/httpserver.cpp

@@ -433,6 +433,14 @@ namespace kt
 		const char* ptr = data.data();
 		Uint32 len = data.size();
 		int pos = TQString(data).find("\r\n\r\n");
+
+		if (!session.logged_in || !checkSession(hdr))
+		{
+			// You can't post torrents if you are not logged in
+			// or the session is not OK
+			redirectToLoginPage(hdlr);
+			return;
+		}
 		
 		if (pos == -1 || pos + 4 >= len || ptr[pos + 4] != 'd')
 		{

plugins/webinterface/php_handler.cpp

@@ -82,7 +82,9 @@ namespace kt
 			
 		for ( it = args.begin(); it != args.end(); ++it )
 		{
-			ts << TQString("$_REQUEST['%1']=\"%2\";\n").arg(it.key()).arg(it.data());
+			// Check for string delimiters, don't want PHP injection attacks
+			if (!containsDelimiters(it.key()) && !containsDelimiters(it.data()))
+				ts << TQString("$_REQUEST['%1']=\"%2\";\n").arg(it.key()).arg(it.data());
 		}
 		ts.writeRawBytes(php_s.data() + off,php_s.size() - off); // the rest of the script
 		ts << flush;
@@ -98,6 +100,11 @@ namespace kt
 #endif
 		return launch(data);
 	}
+
+	bool PhpHandler::containsDelimiters(const QString & str)
+	{
+		return str.contains("\"") || str.contains("'");
+	}
 	
 	void PhpHandler::onExited()
 	{

plugins/webinterface/php_handler.h

@@ -46,6 +46,9 @@ namespace kt
 		
 	signals:
 		void finished();
+
+	private:
+		bool containsDelimiters(const QString & str);
 		
 	private:
 		TQByteArray output;