--- webcalendar-0.9.45.orig/activity_log.php
+++ webcalendar-0.9.45/activity_log.php
@@ -21,6 +21,7 @@
   "webcal_entry.cal_name, webcal_entry_log.cal_log_id " .
   "FROM webcal_entry_log, webcal_entry " .
   "WHERE webcal_entry_log.cal_entry_id = webcal_entry.cal_id ";
+$startid = getIntValue ( 'startid', true );
 if ( ! empty ( $startid ) )
   $sql .= "AND webcal_entry_log.cal_log_id <= $startid ";
 $sql .= "ORDER BY webcal_entry_log.cal_log_id DESC";
--- webcalendar-0.9.45.orig/admin_handler.php
+++ webcalendar-0.9.45/admin_handler.php
@@ -10,6 +10,12 @@
 if ( $error == "" ) {
   while ( list ( $key, $value ) = each ( $HTTP_POST_VARS ) ) {
     $setting = substr ( $key, 6 );
+    // validate key name.  should start with "admin_" and not include
+    // any unusual characters that might cause SQL injection
+    if ( ! preg_match ( '/admin_[A-Za-z0-9_]+$/', $key ) ) {
+      die( 'Invalid admin setting name "' . $key . '"' );
+    }
+
     if ( strlen ( $setting ) > 0 ) {
       $sql = "DELETE FROM webcal_config WHERE cal_setting = '$setting'";
       if ( ! dbi_query ( $sql ) ) {
--- webcalendar-0.9.45.orig/assistant_edit.php
+++ webcalendar-0.9.45/assistant_edit.php
@@ -1,16 +1,24 @@
 <?php
 include_once 'includes/init.php';
 
+if ( empty ( $login) || $login == "__public__" ) {
+  // do not allow public access
+  do_redirect ( empty ( $STARTVIEW ) ? "month.php" : "$STARTVIEW" );
+  exit;
+}
+
 if ($user != $login)
   $user = (($is_admin || $is_nonuser_admin) && $user) ? $user : $login;
 
 if ( $groups_enabled == "Y" ) {
   $INC = array('js/assistant_edit.php');
+} else {
+  $INC = '';
 }
 print_header($INC);
 ?>
 
-<form action="assistant_edit_handler.php" method="post" name="editentryform">
+<form action="assistant_edit_handler.php" method="post" name="assistanteditform">
 <?php
   if ($user) echo "<input type=\"hidden\" name=\"user\" value=\"$user\" />\n";
   if ( $is_nonuser_admin ) {
--- webcalendar-0.9.45.orig/edit_report_handler.php
+++ webcalendar-0.9.45/edit_report_handler.php
@@ -138,7 +138,7 @@
   $values[] = "'html'";
 
   $names[] = "cal_report_name";
-  if ( empty ( $report_name ) )
+  if ( empty ( $report_name ) || trim ( $report_name ) == '' )
     $report_name = translate ( "Unnamed Report" );
   $values[] = "'$report_name'";
 
@@ -254,9 +254,9 @@
 
 <h2><?php etranslate("Error")?></h2>
 <blockquote>
-<?php echo htmlentities ( $error ); ?>
+<?php echo  $error ; ?>
 </blockquote>
 
 <?php print_trailer(); ?>
 </body>
-</html>
\ No newline at end of file
+</html>
--- webcalendar-0.9.45.orig/edit_template.php
+++ webcalendar-0.9.45/edit_template.php
@@ -42,7 +42,7 @@
 // Handle form submission
 if ( $REQUEST_METHOD == 'POST' ) {
   //$template = getPostValue ( "template" );
-  $template = $_POST['template'];
+  $template = getPostValue ( "template" );
   //echo "Template: " . htmlentities ( $template ) . "<br />\n"; exit;
   if ( $found ) {
     $sql = "UPDATE webcal_report_template " .
--- webcalendar-0.9.45.orig/export_handler.php
+++ webcalendar-0.9.45/export_handler.php
@@ -42,7 +42,7 @@
   if ($id == "all") {
       $sql .= "WHERE webcal_entry.cal_id = webcal_entry_user.cal_id AND " .
 	" ( webcal_entry_user.cal_login = '" . $login . "'";
-      if ( $user && $user != $login ) {
+      if ( !empty($user) && $user != $login ) {
         $sql .= " OR webcal_entry_user.cal_login = '$user'";
       } else if ( $include_layers && $layers ) {
         foreach ( $layers as $layer ) {
@@ -67,7 +67,7 @@
         // TODO: add support for user in URL so we can export from other
         // calendars, particularly non-user calendars.
 	//"webcal_entry_user.cal_id = '$id'";
-      if ( $user && $user != $login ) {
+      if ( !empty($user) && $user != $login ) {
         $sql .= " OR webcal_entry_user.cal_login = '$user'";
       } else if ( $layers ) {
         foreach ( $layers as $layer ) {
@@ -1006,19 +1006,32 @@
 /*** Let's go ***/
 /*******************************************/
 
-$id = $HTTP_POST_VARS["id"];
-$format = $HTTP_POST_VARS["format"];
-$use_all_dates = $HTTP_POST_VARS["use_all_dates"];
-$include_layers = $HTTP_POST_VARS["include_layers"];
-$fromyear = $HTTP_POST_VARS["fromyear"];
-$frommonth = $HTTP_POST_VARS["frommonth"];
-$fromday = $HTTP_POST_VARS["fromday"];
-$endyear = $HTTP_POST_VARS["endyear"];
-$endmonth = $HTTP_POST_VARS["endmonth"];
-$endday = $HTTP_POST_VARS["endday"];
-$modyear = $HTTP_POST_VARS["modyear"];
-$modmonth = $HTTP_POST_VARS["modmonth"];
-$modday = $HTTP_POST_VARS["modday"];
+
+
+$id = getIntValue  ( 'id', true );
+$format = getValue  ( 'format' );
+if ( $format != 'ical' && $format != 'vcal' && $format != 'pilot-csv' &&
+  $format != 'pilot-text' )
+  die_miserable_death ( "Invalid format '" . $format . "'" );
+
+$use_all_dates = getPostValue  ( 'use_all_dates' );
+if ( $use_all_dates != 'y' )
+  $use_all_dates = '';
+
+$include_layers = getPostValue  ( 'include_layers' );
+if ( $include_layers != 'y' )
+ $include_layers = '';
+
+$fromyear = getIntValue  ( 'fromyear', true );
+$frommonth = getIntValue  ( 'frommonth', true );
+$fromday = getIntValue  ( 'fromday', true );
+$endyear = getIntValue  ( 'endyear', true );
+$endmonth = getIntValue  ( 'endmonth', true );
+$endday = getIntValue  ( 'endday', true );
+$modyear = getIntValue  ( 'modyear', true );
+$modmonth = getIntValue  ( 'modmonth', true );
+$modday = getIntValue  ( 'modday', true );
+
 
 mt_srand((float) microtime()*1000000);
 
--- webcalendar-0.9.45.orig/includes/functions.php
+++ webcalendar-0.9.45/includes/functions.php
@@ -36,6 +36,7 @@
   "single_user_login" => 1,
   "use_http_auth" => 1,
   "user_inc" => 1,
+  "includedir" => 1,
   "NONUSER_PREFIX" => 1,
   "languages" => 1,
   "browser_languages" => 1,
--- webcalendar-0.9.45.orig/includes/js/assistant_edit.php
+++ webcalendar-0.9.45/includes/js/assistant_edit.php
@@ -3,18 +3,18 @@
 function selectUsers () {
   // find id of user selection object
   var listid = 0;
-  for ( i = 0; i < document.forms[0].elements.length; i++ ) {
-    if ( document.forms[0].elements[i].name == "users[]" )
+  for ( i = 0; i < document.assistanteditform.elements.length; i++ ) {
+    if ( document.assistanteditform.elements[i].name == "users[]" )
       listid = i;
   }
-  url = "usersel.php?form=editentryform&listid=" + listid + "&users=";
+  url = "usersel.php?form=assistanteditform&listid=" + listid + "&users=";
   // add currently selected users
-  for ( i = 0, j = 0; i < document.forms[0].elements[listid].length; i++ ) {
-    if ( document.forms[0].elements[listid].options[i].selected ) {
+  for ( i = 0, j = 0; i < document.assistanteditform.elements[listid].length; i++ ) {
+    if ( document.assistanteditform.elements[listid].options[i].selected ) {
       if ( j != 0 )
         url += ",";
       j++;
-      url += document.forms[0].elements[listid].options[i].value;
+      url += document.assistanteditform.elements[listid].options[i].value;
     }
   }
   //alert ( "URL: " + url );
--- webcalendar-0.9.45.orig/includes/validate.php
+++ webcalendar-0.9.45/includes/validate.php
@@ -38,6 +38,18 @@
           $login_pw = split('\|', decode_string ($encoded_login));
           $login = $login_pw[0];
           $cryptpw = $login_pw[1];
+          // Security fix.  Don't allow certain types of characters in
+          // the login.  WebCalendar does not escape the login name in
+          // SQL requests.  So, if the user were able to set the login
+          // name to be "x';drop table u;",
+          // they may be able to affect the database.
+          if ( ! empty ( $login ) ) {
+            if ( $login != addslashes ( $login ) ) {
+              echo "Illegal characters in login " .
+                "<tt>" . htmlentities ( $login ) . "</tt>";
+              exit;
+            }
+          }
           // make sure we are connected to the database for password check
           $c = dbi_connect ( $db_host, $db_login, $db_password, $db_database );
           if ( ! $c ) {
--- webcalendar-0.9.45.orig/layers_toggle.php
+++ webcalendar-0.9.45/layers_toggle.php
@@ -15,10 +15,10 @@
 if ( $is_admin && ! empty ( $public ) && $public_access == "Y" ) {
   $updating_public = true;
   $layer_user = "__public__";
-  $u_url = "&amp;public=1";
+  $url = 'layers.php?public=1';
 } else {
   $layer_user = $login;
-  $u_url = "";
+  $url = 'layers.php';
 }
 
 $sql = "DELETE FROM webcal_user_pref WHERE cal_login = '$layer_user' " .
@@ -37,15 +37,7 @@
 }
 
 if ( empty ( $error ) ) {
-  // Go back to where we where if we can figure it out.
-  if ( strlen ( $ret ) )
-    do_redirect ( $ret );
-  else if ( strlen ( $HTTP_REFERER ) )
-    do_redirect ( $HTTP_REFERER );
-  else if ( strlen ( get_last_view() )  )
-    do_redirect ( get_last_view() );
-  else
-    do_redirect ( "$STARTVIEW.php" );
+  do_redirect($url);
 }
 
 print_header();
--- webcalendar-0.9.45.orig/login.php
+++ webcalendar-0.9.45/login.php
@@ -62,6 +62,10 @@
       $login = stripslashes ( $login );
     }
     $login = trim ( $login );
+    if ( $login != addslashes ( $login ) ) {
+      echo "Illegal characters in login";
+      exit;
+    }
     if ( user_valid_login ( $login, $password ) ) {
       user_load_variables ( $login, "" );
       // set login to expire in 365 days
--- webcalendar-0.9.45.orig/pref_handler.php
+++ webcalendar-0.9.45/pref_handler.php
@@ -16,6 +16,15 @@
 while ( list ( $key, $value ) = each ( $HTTP_POST_VARS ) ) {
   $setting = substr ( $key, 5 );
   $prefix = substr ( $key, 0, 5 );
+
+  if ( $key == 'user' )
+    continue;
+  // validate key name.  should start with "pref_" and not include
+  // any unusual characters that might cause SQL injection
+  if ( ! preg_match ( '/pref_[A-Za-z0-9_]+$/', $key ) ) {
+    die( 'Invalid admin setting name "' . $key . '"' );
+  }
+
   //echo "Setting = $setting, key = $key, prefix = $prefix <br />\n";
   if ( strlen ( $setting ) > 0 && $prefix == "pref_" ) {
     $sql =
--- webcalendar-0.9.45.orig/tools/send_reminders.php
+++ webcalendar-0.9.45/tools/send_reminders.php
@@ -1,4 +1,4 @@
-#!/usr/local/bin/php -q
+#!/usr/bin/php -q
 <?php
 // This script should be setup to run periodically on your system.
 // You could run it once every minute, but every 5-15 minutes should be
--- webcalendar-0.9.45.orig/tools/upgrade_to_0.9.7.pl
+++ webcalendar-0.9.45/tools/upgrade_to_0.9.7.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl
+#!/usr/bin/perl
 #
 # This script will update a pre-0.9.7 WebCalendar database to have the
 # correct tables for 0.9.7.
--- webcalendar-0.9.45.orig/settings.php.tpl
+++ webcalendar-0.9.45/settings.php.tpl
@@ -0,0 +1,20 @@
+<?php
+/*******************************************************************\
+* settings.php.tpl: site configuration is managed by debconf rather *
+* than via the install script in ${SITE_ROOT}/install/index.php     *
+* Don't edit this file directly.  All changes made will be removed  *
+* upon upgrade                                                      *
+\*******************************************************************/
+
+db_type: DEBCONF::DB_TYPE
+db_host: DEBCONF::DB_HOST
+db_database: DEBCONF::DB_DATABASE
+db_login: DEBCONF::DB_LOGIN
+db_password: DEBCONF::DB_PASSWORD
+db_persistent: DEBCONF::DB_PERSISTENT
+single_user: DEBCONF::SINGLE_USER_MODE
+single_user_login: DEBCONF::SINGLE_USER_LOGIN
+use_http_auth: DEBCONF::USE_HTTP_AUTH
+readonly: false
+user_inc: user.php
+?>
--- webcalendar-0.9.45.orig/config.php.template
+++ webcalendar-0.9.45/config.php.template
@@ -0,0 +1,229 @@
+<?php
+
+// Site-specific settings.
+// Configure these for your site.
+// You shouldn't have to modify any files outside of this one.
+// When you're done here, try accessing WebCalendar as an admin
+// user and go to the System Settings page (admin.php) to change system
+// settings.
+//
+// Note: if you enable LDAP support, you will also need to modify
+// user-ldap.php.
+//
+/////////////////////////////////////////////////////////////////
+
+/********************************************************************\
+*  This conf file is managed by debconf, any changes you make will   *
+*  be lost on upgrade.                                               *
+\********************************************************************/
+
+$PROGRAM_NAME = "WebCalendar v0.9.44 (02 Aug 2004)";
+$PROGRAM_URL = "http://webcalendar.sourceforge.net/";
+
+$db_type = "DEBCONF::DB_TYPE";
+$db_host = "DEBCONF::DB_HOST";
+$db_login = "DEBCONF::DB_LOGIN";
+$db_password = "DEBCONF::DB_PASSWORD";
+$db_database = "DEBCONF::DB_DATABASE";
+$db_persistent = DEBCONF::DB_PERSISTENT;
+
+// Read-only mode: You can set this to true to create a read-only calendar.
+// If you enable $single_user_login (below), no login will be required,
+// making this a publicly viewable calendar.  In order to add events to
+// a setup like this, you will need to setup another installation of this
+// application that is not read-only.
+// If $readonly is enabled in multi-user mode, only admin users will able
+// to add/edit/delete events.
+// NOTE: Approvals are not disabled in read-only.  You must also disable
+// approvals if you don't want to use them.
+// NOTE #2: Using $readonly has mostly been superceded by the new public
+// access calendar (added in version 0.9.35).  The new system allows
+// a public access calendar with no login or a regular calendar with
+// a valid login.  This is configured in the admin web interface.
+// If you want to use the new system (recommended), leave this $readonly
+// setting set to "N".
+$readonly = "N";
+
+// Are you setting this up as a multi-user system?
+// You can always start as a single-user system and change to multi-user
+// later.  To enable single-user mode, uncomment out the following line
+// and set it to a login name (that you would use if you ever switched to
+// multi-user).  In single-user mode, you will not be prompted for a login,
+// nor will you be asked to select participants for events.
+// NOTE: If you select single-user and then upgrade to multi-user later,
+// you'll have to add in the login name you've set below to the cal_user
+// table.  Set $single_user to either true or false.  If true, make sure
+// $single_user_login is defined.
+$single_user = "DEBCONF::SINGLE_USER_MODE";
+$single_user_login = "DEBCONF::SINGLE_USER_LOGIN";
+
+// Do you want to use web-based login or use HTTP authorization?
+// NOTE: You can only use HTTP authorization if PHP is built as
+// an Apache module.
+// NOTE #2: There's no need to use this if you're running single
+// user mode.
+// Set the following to true to use http-based authorization.
+// web-based login.)
+// If you want to setup a public calendar with HTTP-based authentication,
+// see FAQ for instructions.
+$use_http_auth = DEBCONF::USE_HTTP_AUTH;
+
+
+// Which user schema to use.  Currently, you can use the default webcal_user
+// table, LDAP or NIS.  These files are found in the includes directory.
+// Pick just one of the following:
+
+// webcal_user table: default
+$user_inc = "user.php";
+// LDAP: if you select this, you must also configure some variables
+// in includes/user-ldap.php such as your LDAP server...
+//$user_inc = "user-ldap.php";
+// NIS: if you select this, you must also configure some variables
+// in includes/user-nis.php
+//$user_inc = "user-nis.php";
+
+// We can add extra 'nonuser' calendars such as a corporate calendar,
+// holiday calendar, departmental calendar, etc.  We need a unique prefix
+// for these calendars as not to get mixed up with real logins.  This prefix
+// should be a Maximum of 5 characters and should NOT change once set!
+$NONUSER_PREFIX = '_NUC_';
+
+// Language options  The first is the name presented to users while
+// the second is the filename (without the ".txt") that must exist
+// in the translations subdirectory.
+$languages = array (
+  "Browser-defined" =>"none",
+  "English" =>"English-US",
+  "Basque" => "Basque",
+  "Bulgarian" => "Bulgarian",
+  "Catalan" => "Catalan",
+  "Chinese (Traditonal/Big5)" => "Chinese-Big5",
+  "Chinese (Simplified/GB2312)" => "Chinese-GB2312",
+  "Czech" => "Czech",
+  "Danish" => "Danish",
+  "Dutch" =>"Dutch",
+  "Estonian" => "Estonian",
+  "Finnish" =>"Finnish",
+  "French" =>"French",
+  "Galician" => "Galician",
+  "German" =>"German",
+  "Holo (Taiwanese)" => "Holo-Big5",
+  "Hungarian" =>"Hungarian",
+  "Icelandic" => "Icelandic",
+  "Italian" => "Italian",
+  "Japanese" => "Japanese",
+  "Korean" =>"Korean",
+  "Norwegian" => "Norwegian",
+  "Polish" => "Polish",
+  "Portuguese" =>"Portuguese",
+  "Portuguese/Brazil" => "Portuguese_BR",
+  "Russian" => "Russian",
+  "Spanish" =>"Spanish",
+  "Swedish" =>"Swedish",
+  "Turkish" =>"Turkish"
+  // add new languages here!  (don't forget to add a comma at the end of
+  // last line above.)
+);
+
+// If the user sets "Browser-defined" as their language setting, then
+// use the $HTTP_ACCEPT_LANGUAGE settings to determine the language.
+// The array below translates browser language abbreviations into
+// our available language files.
+// NOTE: These should all be lowercase on the left side even though
+// the proper listing is like "en-US"!
+// Not sure what the abbreviation is?  Check out the following URL:
+// http://www.geocities.com/click2speak/languages.html
+$browser_languages = array (
+  "eu" => "Basque",
+  "bg" => "Bulgarian",
+  "ca" => "Catalan",
+  "zh" => "Chinese-GB2312",    // Simplified Chinese
+  "zh-cn" => "Chinese-GB2312",
+  "zh-tw" => "Chinese-Big5",   // Traditional Chinese
+  "cs" => "Czech",
+  "en" => "English-US",
+  "en-us" => "English-US",
+  "en-gb" => "English-US",
+  "da" => "Danish",
+  "nl" =>"Dutch",
+  "ee" => "Estonian",
+  "fi" =>"Finnish",
+  "fr" =>"French",
+  "fr-ch" =>"French", // French/Swiss
+  "fr-ca" =>"French", // French/Canada
+  "gl" => "Galician",
+  "de" =>"German",
+  "de-at" =>"German", // German/Austria
+  "de-ch" =>"German", // German/Switzerland
+  "de-de" =>"German", // German/German
+  "hu" => "Hungarian",
+  "zh-min-nan-tw" => "Holo-Big5",
+  "is" => "Icelandic",
+  "it" => "Italian",
+  "it-ch" => "Italian", // Italian/Switzerland
+  "ja" => "Japanese",
+  "ko" =>"Korean",
+  "no" => "Norwegian",
+  "pl" => "Polish",
+  "pt" =>"Portuguese",
+  "pt-br" => "Portuguese_BR", // Portuguese/Brazil
+  "ru" =>"Russian",
+  "es" =>"Spanish",
+  "sv" =>"Swedish",
+  "tr" =>"Turkish",
+  "cy" => "Welsh"
+);
+
+// The following comments will be picked up by update_translation.pl so
+// translators will be aware that they also need to translate language names.
+//
+// translate("English")
+// translate("Basque")
+// translate("Bulgarian")
+// translate("Catalan")
+// translate("Chinese (Traditonal/Big5)")
+// translate("Chinese (Simplified/GB2312)")
+// translate("Czech")
+// translate("Danish")
+// translate("Dutch")
+// translate("Estonian")
+// translate("Finnish")
+// translate("French")
+// translate("Galician")
+// translate("German")
+// translate("Holo (Taiwanese)")
+// translate("Hungarian")
+// translate("Icelandic")
+// translate("Italian")
+// translate("Japanese")
+// translate("Korean")
+// translate("Norwegian")
+// translate("Polish")
+// translate("Portuguese")
+// translate("Portuguese/Brazil")
+// translate("Russian")
+// translate("Spanish")
+// translate("Swedish")
+// translate("Turkish")
+
+if ( $single_user != "Y" )
+  $single_user_login = "";
+
+// Make sure magic quotes is enabled, since this app requires it.
+if ( get_magic_quotes_gpc () == 0 ) {
+  ob_start ();
+  phpinfo ();
+  $val = ob_get_contents ();
+  ob_end_clean ();
+  echo "<html>\n<title>Error</title>\n</head>\n<body>\n" .
+    "Error: you must reconfigure your <tt>php.ini</tt> file to " .
+    "have <span style=\"font-weight:bold;\">magic_quotes_gpc</span> set to <span style=\"font-weight:bold;\">ON</span>.<br /><br />\n";
+  if ( preg_match ( "/>([^<>]*php.ini)</", $val, $matches ) ) {
+    echo "Please edit the following file and restart your server:<br /><br />\n" .
+      "<blockquote>\n<tt>" . $matches[1] . "</tt>\n</blockquote>\n";
+  }
+  echo "</body>\n</html>\n";
+  exit;
+}
+
+?>
--- webcalendar-0.9.45.orig/apache.conf
+++ webcalendar-0.9.45/apache.conf
@@ -0,0 +1,20 @@
+
+Alias /webcalendar /usr/share/webcalendar
+
+<DirectoryMatch /usr/share/webcalendar/>
+Options +FollowSymLinks
+AllowOverride None
+order allow,deny
+allow from all
+<IfModule mod_php3.c>
+  php3_magic_quotes_gpc On
+  php3_track_vars On
+  php3_include_path .
+</IfModule>
+<IfModule mod_php4.c>
+  php_flag magic_quotes_gpc On
+  php_flag track_vars On
+  php_flag register_globals On
+  php_value include_path .
+</IfModule>
+</DirectoryMatch>
--- webcalendar-0.9.45.orig/debian/changelog
+++ webcalendar-0.9.45/debian/changelog
@@ -0,0 +1,75 @@
+webcalendar (0.9.45-4sarge3) stable-security; urgency=high
+
+  * Fixed multiple security vulnerabilities
+    (http://www.ush.it/2005/11/28/webcalendar-multiple-vulnerabilities/)
+  * Fixed multiple SQL Injection vulnerabilities (CVE-2005-3949)
+    files: activity_log.php startid parameter, edit_template.php template
+    parameter, and export_handler.php multiple parameters.  admin_handler.php
+    is not vulnerable in this version
+  * Fixed CRLF injection XSS/response splitting vulnerability (CVE-2005-3982)
+    files: layers_toggle.php ret parameter (required change to url param)
+  * Fixed local file overwrite vulnerability (CVE-2005-3961)
+    files: export_handler.php id parameter
+
+ -- Tim Peeler <thp@linuxforce.net>  Tue, 28 Feb 2006 11:48:14 -0500
+
+webcalendar (0.9.45-4sarge2) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team
+  * Fix to correct arbitrary code execution CAN-2005-2717
+
+ -- Michael Stone <mstone@debian.org>  Thu, 01 Sep 2005 20:32:23 -0400
+
+webcalendar (0.9.45-4sarge1) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team
+  * Applied fixes by Tim Peeler to correct unauthorised access
+    [assistant_edit.php, includes/js/assistant_edit.php, Bug#315671,
+    CAN-2005-0474]
+
+ -- Martin Schulze <joey@infodrom.org>  Wed, 20 Jul 2005 19:53:08 +0200
+
+webcalendar (0.9.45-4) unstable; urgency=low
+
+  * Fixed a bug in the postinst script that prevented installation when
+    passwords were non-alphanumeric (closes: #296935, #296866)
+  * Changed template to make passwords of debconf type password instead
+    of string (closes: #298475)
+  * Fixed postinst to purge database password after sql client completes
+    installation (closes: #302625, #302631)
+  * Added a chmod to postinst to prevent world read of settings.php
+    (closes: #303016)
+  * Fixed prerm to remove settings.php when doing a purge (closes: #298476)
+
+ -- Tim Peeler <thp@linuxforce.net>  Fri, 25 Mar 2005 12:41:20 -0500
+
+webcalendar (0.9.45-3) unstable; urgency=low
+
+  * removed mysql-server or postgres requirements (closes: #291590)
+  * added patch to fix sql injection bug CAN-2005-0474 (closes: #295960, #296280)
+
+ -- Tim Peeler <thp@linuxforce.net>  Wed, 22 Dec 2004 10:18:14 -0500
+
+webcalendar (0.9.45-2) unstable; urgency=low
+
+  * fixed a problem with postinst (closes: #286405)
+
+ -- Tim Peeler <thp@linuxforce.net>  Wed, 22 Dec 2004 10:18:14 -0500
+
+webcalendar (0.9.45-1) unstable; urgency=low
+
+  * new version of webcalendar (adds security enhancements)
+  * added a post install configure script
+  * added depends for php4-mysql | php4-pgsql (closes: #285795)
+  * moved docs/* to /usr/share/doc/webcalendar (closes: #285798)
+  * created a README (closes: #285183)
+  * changed short description (closes: #285680)
+
+ -- Tim Peeler <thp@linuxforce.net>  Tue, 14 Dec 2004  3:34:15 -0500
+
+webcalendar (0.9.44-1) unstable; urgency=low
+
+  * Initial Release. (closes: #261761)
+
+ -- Tim Peeler <thp@linuxforce.net>  Mon, 08 Nov 2004  2:52:08 -0500
+
--- webcalendar-0.9.45.orig/debian/webcalendar.postrm
+++ webcalendar-0.9.45/debian/webcalendar.postrm
@@ -0,0 +1,45 @@
+#! /bin/sh
+# postrm script for webcalendar
+#
+# see: dh_installdeb(1)
+
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+        purge)
+            . /usr/share/debconf/confmodule
+            db_purge
+            rm -f /etc/webcalendar/settings.php
+
+        ;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+
+
+        ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- webcalendar-0.9.45.orig/debian/webcalendar.postinst
+++ webcalendar-0.9.45/debian/webcalendar.postinst
@@ -0,0 +1,136 @@
+#! /bin/sh
+# postinst script for webcalendar
+#
+# see: dh_installdeb(1)
+
+Version="0.9.45-1"
+
+set -e
+. /usr/share/debconf/confmodule
+
+quote() {
+    echo $1 | sed -e 's/\//\\\//g';
+}
+
+install_database() {
+    DB_TYPE=$0
+    DB_HOST=$1
+    DB_LOGIN=$2
+    DB_PASSWORD=$3
+    DB_DATABASE=$4
+
+    if [ "$DB_TYPE" = "mysql" ] ; then
+        mysql --user=$DB_LOGIN --password=$DB_PASSWORD $DB_DATABASE < \
+            /usr/share/webcalendar/
+    fi
+
+    if [ "$DB_TYPE" = "postgresql" ] ; then
+        true;
+    fi
+
+    db_set webcalendar/status/db_installed true
+}
+
+configure () {
+
+    CONF_FILE="/etc/webcalendar/settings.php"
+    CF_TEMPLATE="/etc/webcalendar/settings.php.tpl"
+
+    db_get webcalendar/status/debconf_managed
+    if [ "$RET" = "false" ]; then
+        return 0
+    fi
+
+    db_get webcalendar/conf/db_type;           DB_TYPE=`quote $RET`;
+    db_get webcalendar/conf/db_host;           DB_HOST=`quote $RET`;
+    db_get webcalendar/conf/db_login;          DB_LOGIN=`quote $RET`;
+    db_get webcalendar/conf/db_password;       DB_PASSWORD=`quote $RET`;
+    db_get webcalendar/conf/db_database;       DB_DATABASE=`quote $RET`;
+    db_get webcalendar/conf/db_persistent;     DB_PERSISTENT=`quote $RET`;
+    db_get webcalendar/conf/use_http_auth;     USE_HTTP_AUTH=`quote $RET`;
+    db_get webcalendar/conf/single_user_mode;  SINGLE_USER_MODE=`quote $RET`;
+    db_get webcalendar/conf/single_user_login; SINGLE_USER_LOGIN=`quote $RET`;
+
+    #db_get webcalendar/status/db_installed; DB_INSTALLED=$RET
+
+    #if [ "$DB_INSTALLED" = "false"]; then
+    #    install_database $DB_TYPE $DB_HOST $DB_LOGIN $DB_PASSWORD \
+    #        $DB_DATABASE
+    #fi
+
+    if [ "$SINGLE_USER_MODE" = "true" ] ; then
+        SINGLE_USER_MODE="Y"
+    else
+        SINGLE_USER_MODE="N"
+    fi
+
+    cat $CF_TEMPLATE | perl -e " \
+        my %CF_REPLACE = ( \
+            'DB_TYPE'           => qw/$DB_TYPE/, \
+            'DB_HOST'           => qw/$DB_HOST/, \
+            'DB_TYPE'           => qw/$DB_TYPE/, \
+            'DB_HOST'           => qw/$DB_HOST/, \
+            'DB_LOGIN'          => qw/$DB_LOGIN/, \
+            'DB_PASSWORD'       => qw/$DB_PASSWORD/, \
+            'DB_DATABASE'       => qw/$DB_DATABASE/, \
+            'DB_PERSISTENT'     => qw/$DB_PERSISTENT/, \
+            'USE_HTTP_AUTH'     => qw/$USE_HTTP_AUTH/, \
+            'SINGLE_USER_MODE'  => qw/$SINGLE_USER_MODE/, \
+            'SINGLE_USER_LOGIN' => qw/$SINGLE_USER_LOGIN/ \
+        ); \
+        while (my \$line = <STDIN>) { \
+            foreach my \$search (keys %CF_REPLACE) { \
+                my \$replace = \$CF_REPLACE{\$search}; \
+                \$line =~ s/DEBCONF::\$search/\$replace/g; \
+            } \
+            print \$line;
+        } \
+    " > $CONF_FILE
+
+    chown root.www-data $CONF_FILE
+    chmod 640 $CONF_FILE
+
+    db_set webcalendar/conf/db_password "";
+}
+
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+#
+
+case "$1" in
+    configure)
+        # prevent overwriting config on upgrade but allow reconfigure
+        # to work correctly
+        if [ ! $2 ] || ( dpkg --compare-versions $2 le $Version ) ; then
+            configure;
+        fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
+exit 0
+
+
--- webcalendar-0.9.45.orig/debian/webcalendar.links
+++ webcalendar-0.9.45/debian/webcalendar.links
@@ -0,0 +1,8 @@
+etc/webcalendar/settings.php usr/share/webcalendar/includes/settings.php
+usr/share/webcalendar/docs usr/share/doc/webcalendar/docs
+etc/webcalendar/user.php usr/share/webcalendar/includes/user.php 
+etc/webcalendar/user-ldap.php usr/share/webcalendar/includes/user-ldap.php 
+etc/webcalendar/user-nis.php usr/share/webcalendar/includes/user-nis.php 
+etc/webcalendar/print_styles.css usr/share/webcalendar/includes/print_styles.css 
+etc/webcalendar/site_extras.php usr/share/webcalendar/includes/site_extras.php 
+etc/webcalendar/styles.php usr/share/webcalendar/includes/styles.php 
--- webcalendar-0.9.45.orig/debian/webcalendar.templates
+++ webcalendar-0.9.45/debian/webcalendar.templates
@@ -0,0 +1,116 @@
+Template: webcalendar/conf/db_type
+Type: select
+Choices: mysql, postgresql
+Default: mysql
+Description: Select your database type.
+ Webcalendar can be setup to work with either mysql or postgresql.
+
+Template: webcalendar/conf/db_host
+Type: string
+Default: localhost
+Description: Enter the hostname of your SQL server.
+ This is the hostname or ip address of your SQL server.
+
+Template: webcalendar/conf/db_admin_login
+Type: string
+Description: Enter your SQL database admin username.
+  This is your administrative user's name.
+
+Template: webcalendar/conf/db_admin_password
+Type: password
+Description: Enter your SQL database admin password.
+ This is the administrative user's password.  It is used by debconf to
+ configure the webcalendar database.
+
+Template: webcalendar/conf/db_login
+Type: string
+Description: Enter the webcalendar SQL username.
+ This is the username used by webcalendar to connect to your SQL server.
+
+Template: webcalendar/conf/db_password
+Type: password
+Description: Enter the webcalendar SQL password.
+ This is the password used by webcalendar to connect to your SQL server.  
+ If your server doesn't require a password, leave this blank.
+
+Template: webcalendar/conf/db_database
+Type: string
+Description: Enter the name of the webcalendar database.
+ What is the name of the database webcalendar will use?
+
+Template: webcalendar/conf/db_persistent
+Type: boolean
+Default: true
+Description: Use persistent connections?
+ Do you wish to use persistent database connections?
+
+Template: webcalendar/conf/use_http_auth
+Type: boolean
+Default: false
+Description: Use http auth?
+ Webcalendar by default uses the database's webcal_user table for
+ authenticating users.  You can use http auth logins instead and use
+ apache to manage logins, you still have to add users to webcalendar
+ though so unless you like more work say no here.
+
+Template: webcalendar/conf/single_user_mode
+Type: boolean
+Default: false
+Description: Should webcalendar be installed in single user mode?
+ Webcalendar can be installed in single user mode or multi user mode. If it
+ is installed in single user mode, you won't need to login.  It isn't
+ recommended that you install in single user mode unless you are running
+ this on a personal server protected by a firewall.
+
+Template: webcalendar/conf/single_user_login
+Type: string
+Description: Enter the name of the webcalendar user.
+ If you have installed webcalendar in single user mode, you need to
+ specify the name of the user to connect as.
+
+Template: webcalendar/status/db_installed
+Type: boolean
+Default: false
+Description: Placeholder to tell if we've previously initialized our database
+
+Template: webcalendar/status/debconf_managed
+Type: boolean
+Default: true
+Description: Allow debconf to manage settings.php?
+ You can allow debconf to manage your settings.php or you can manage your
+ settings manually.
+
+Template: webcalendar/status/debconf_managed_db
+Type: boolean
+Default: true
+Description: Automatically configure database?
+ Do you wish debconf to configure your database automatically?  If you
+ choose not to have debconf configure your database you will need to
+ read README.debian to install your database manually.
+
+Template: webcalendar/status/debconf_store_admin_pass
+Type: boolean
+Default: true
+Description: Store the SQL admin username and password?
+ Do you wish debconf to store your SQL admin username and password?
+
+Template: webcalendar/status/deconfig_db
+Type: boolean
+Default: true
+Description: Purge database?
+ Do you wish to purge the webcalendar database?
+
+Template: webcalendar/note/admin_user
+Type: note
+Description: Webcalendar administrative user
+ After installing the tables for your sql database you will have access
+ to webcalendar using the standard admin user.  It is STRONGLY suggested
+ that you change the password after logging in. The default login and 
+ password is admin:admin.
+
+Template: webcalendar/note/sql_install
+Type: note
+Description: Don't forget to create your database
+ Webcalendar doesn't create your tables for you.  There are sql
+ scripts in /var/lib/webcalendar/sql which will populate the database.
+ You need to run the one that corresponds to your server.
--- webcalendar-0.9.45.orig/debian/rules
+++ webcalendar-0.9.45/debian/rules
@@ -0,0 +1,84 @@
+#!/usr/bin/make -f
+# Sample debian/rules that uses debhelper.
+# GNU copyright 1997 to 1999 by Joey Hess.
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+# This is the debhelper compatibility version to use.
+# export DH_COMPAT=2
+
+
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -g
+endif
+ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+	INSTALL_PROGRAM += -s
+endif
+
+configure: configure-stamp
+configure-stamp:
+	dh_testdir
+	# Add here commands to configure the package.
+
+	touch configure-stamp
+
+
+build: build-stamp
+
+build-stamp: configure-stamp 
+	dh_testdir
+
+	html2text docs/WebCalendar-SysAdmin.html >  README
+	html2text docs/WebCalendar-Database.html >> README
+	# Add here commands to compile the package.
+	#$(MAKE)
+	#/usr/bin/docbook-to-man debian/webcalendar.sgml > webcalendar.1
+
+	touch build-stamp
+
+clean:
+	dh_testdir
+	dh_testroot
+	rm -f build-stamp configure-stamp
+	rm -f README
+
+	# Add here commands to clean up after the build process.
+	#-$(MAKE) clean
+
+	dh_clean
+
+install: build
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+	dh_install
+
+	# Add here commands to install the package into debian/webcalendar.
+	#$(MAKE) install DESTDIR=$(CURDIR)/debian/webcalendar
+
+
+# Build architecture-independent files here.
+binary-indep: build install
+	dh_testdir
+	dh_testroot
+	dh_installdocs
+	dh_installexamples
+	dh_installchangelogs ChangeLog
+	dh_link
+	dh_compress
+	dh_fixperms
+	dh_installdeb
+	dh_installdebconf
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+# We have nothing to do by default.
+
+# Build architecture-dependent files here.
+binary-arch: build install
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary install configure
--- webcalendar-0.9.45.orig/debian/install
+++ webcalendar-0.9.45/debian/install
@@ -0,0 +1,18 @@
+apache.conf etc/webcalendar
+includes/user.php etc/webcalendar
+includes/user-ldap.php etc/webcalendar
+includes/user-nis.php etc/webcalendar
+includes/print_styles.css etc/webcalendar
+includes/site_extras.php etc/webcalendar
+includes/styles.php etc/webcalendar
+settings.php.tpl etc/webcalendar
+*.php usr/share/webcalendar
+*.gif usr/share/webcalendar
+*.sql var/lib/webcalendar/sql
+install-datebook.patch usr/share/webcalendar
+includes/ usr/share/webcalendar
+install/ usr/share/webcalendar
+tools/ usr/share/webcalendar
+translations/ usr/share/webcalendar
+ws/ usr/share/webcalendar
+docs/ usr/share/webcalendar
--- webcalendar-0.9.45.orig/debian/docs
+++ webcalendar-0.9.45/debian/docs
@@ -0,0 +1,4 @@
+README
+README.html
+AUTHORS
+UPGRADING.html
--- webcalendar-0.9.45.orig/debian/dirs
+++ webcalendar-0.9.45/debian/dirs
@@ -0,0 +1,4 @@
+/usr/share/webcalendar
+/etc/webcalendar
+/usr/share/doc/webcalendar
+/var/lib/webcalendar/sql
--- webcalendar-0.9.45.orig/debian/copyright
+++ webcalendar-0.9.45/debian/copyright
@@ -0,0 +1,14 @@
+This package was debianized by Tim Peeler <thp@linuxforce.net> on 
+Tue, 14 Dec 2004  3:34:15 -0500.
+
+It was downloaded from http://webcalendar.sourceforge.net/
+
+Upstream Author: Craig Knudsen <cknudsen@cknudsen.com>
+
+Copyright:
+
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+See /usr/share/common-licenses/GPL for the full license.
+
--- webcalendar-0.9.45.orig/debian/control
+++ webcalendar-0.9.45/debian/control
@@ -0,0 +1,16 @@
+Source: webcalendar
+Section: web
+Priority: optional
+Maintainer: Tim Peeler <thp@linuxforce.net>
+Build-Depends-Indep: debhelper (>= 4.0.0), html2text
+Standards-Version: 3.6.1
+
+Package: webcalendar
+Architecture: all
+Depends: ${misc:Depends}, php4, php4-cli | php4-cgi, php4-mysql | php4-pgsql, apache | httpd
+Recommends: mysql-server | postgresql
+Description: PHP-Based multi-user calendar
+ WebCalendar is a PHP-based calendar application that can be configured
+ as a single-user calendar, a multi-user calendar for groups of users,
+ or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle,
+ DB2, Interbase or ODBC is required.
--- webcalendar-0.9.45.orig/debian/compat
+++ webcalendar-0.9.45/debian/compat
@@ -0,0 +1 @@
+4
--- webcalendar-0.9.45.orig/debian/webcalendar.config
+++ webcalendar-0.9.45/debian/webcalendar.config
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+db_input high webcalendar/status/debconf_managed || true
+db_go || true
+
+db_get webcalendar/status/debconf_managed
+if [ "$RET" = true ]; then
+    db_input medium   webcalendar/conf/db_type          || true
+    db_input medium   webcalendar/conf/db_host          || true
+    db_input critical webcalendar/conf/db_login         || true
+    db_input critical webcalendar/conf/db_password      || true
+    db_input critical webcalendar/conf/db_database      || true
+    db_input low      webcalendar/conf/db_persistent    || true
+    db_input low      webcalendar/conf/use_http_auth    || true
+    db_input medium   webcalendar/conf/single_user_mode || true
+    db_go || true
+
+    db_get webcalendar/conf/single_user_mode 
+    if [ "$RET" = true ] ; then
+        db_input medium webcalendar/conf/single_user_login  || true
+        db_go || true
+    fi
+
+    db_input high webcalendar/note/sql_install || true
+    db_input high webcalendar/note/admin_user || true
+    db_go || true
+fi
+
