From 2bce7cfae8cd68f6de3193b06e8f04a65c7950a7 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Tue, 3 Jul 2018 07:32:46 +0200
Subject: add upstream patch to fix SQL injection CVE-2018-13049

---
 3391f10eacec880aebcd4297bd2658ae13473947.patch | 22 ++++++++++++++++++++++
 glpi.spec                                      |  8 +++++++-
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 3391f10eacec880aebcd4297bd2658ae13473947.patch

diff --git a/3391f10eacec880aebcd4297bd2658ae13473947.patch b/3391f10eacec880aebcd4297bd2658ae13473947.patch
new file mode 100644
index 0000000..85ab682
--- /dev/null
+++ b/3391f10eacec880aebcd4297bd2658ae13473947.patch
@@ -0,0 +1,22 @@
+From 3391f10eacec880aebcd4297bd2658ae13473947 Mon Sep 17 00:00:00 2001
+From: Johan Cwiklinski <jcwiklinski@teclib.com>
+Date: Mon, 2 Jul 2018 08:12:32 +0200
+Subject: [PATCH] Cast limits to integer; fixes #4270
+
+---
+ inc/search.class.php | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/inc/search.class.php b/inc/search.class.php
+index 79c32856bd..b6f684be26 100644
+--- a/inc/search.class.php
++++ b/inc/search.class.php
+@@ -890,7 +890,7 @@ static function constructSQL(array &$data) {
+       $numrows = 0;
+       //No search : count number of items using a simple count(ID) request and LIMIT search
+       if ($data['search']['no_search']) {
+-         $LIMIT = " LIMIT ".$data['search']['start'].", ".$data['search']['list_limit'];
++         $LIMIT = " LIMIT ".(int)$data['search']['start'].", ".(int)$data['search']['list_limit'];
+ 
+          // Force group by for all the type -> need to count only on table ID
+          if (!isset($searchopt[1]['forcegroupby'])) {
diff --git a/glpi.spec b/glpi.spec
index b909d04..f03d7fc 100644
--- a/glpi.spec
+++ b/glpi.spec
@@ -51,7 +51,7 @@ Name:           %{gh_project}
 #global upstream_prever  RC2
 # use 9.3.0~RC2 < 9.3 (for plugin compatibility check)
 Version:        %{upstream_version}%{?upstream_prever:~%{upstream_prever}}
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Free IT asset management software
 Summary(fr):    Gestion Libre de Parc Informatique
 
@@ -71,6 +71,8 @@ Source6:        %{name}-minify.php
 # Override PHP configuration for php-fpm
 Source7:        %{name}-user.ini
 
+Patch0:         https://github.com/glpi-project/glpi/commit/3391f10eacec880aebcd4297bd2658ae13473947.patch
+
 BuildArch:      noarch
 BuildRequires:  gettext
 BuildRequires:  php-cli
@@ -294,6 +296,7 @@ techniciens grâce à une maintenance plus cohérente.
 
 %prep
 %setup -q -n %{name}-%{gh_commit}
+%patch0 -p1
 
 grep %{upstream_version} inc/define.php
 
@@ -592,6 +595,9 @@ fi
 
 
 %changelog
+* Tue Jul  3 2018 Remi Collet <remi@remirepo.net> - 9.3.0-2
+- add upstream patch to fix SQL injection CVE-2018-13049
+
 * Thu Jun 28 2018 Remi Collet <remi@remirepo.net> - 9.3.0-1
 - update to 9.3.0 GA
 - add dependency on zend-console
-- 
cgit