15100 2007-08-28 08:54:29 -0700 XMLHttpRequest::urlMatchesDocumentDomain raises error if port information does not match exactly 2008-06-13 23:53:52 -0700 1 1 1 Unclassified WebKit New Bugs 523.x (Safari 3) All All RESOLVED FIXED InRadar P2 Normal --- 1 christian.mittendorf webkit-unassigned abarth ap ddkilzer gavin.sharp sam travis.vachon oldest_to_newest 1344 0 christian.mittendorf 2007-08-28 08:54:29 -0700 The framework that we are using creates Ajax links where it adds the port to an URL. As an example, a site runs under "https://www.foo.com" and the automatically generated JavaScript link looks like "https://www.fool.com:443/Bar/app?abc=123". The current WebCore (Rev 25269) XMLHttpRequest does refuse to make this request with an "Access denied" error because the site url does not include the explicit port information ("documentURL.port() == url.port()" is false). In my example the documentURL.port() would be 0 and url.port() would be 443. Although using https without any specific port would result in using port 443 anyway. IE and Firefox do allow these links and perform the Ajax request without an error. I would suggest to either remove the test that the port must match in both urls or to add more logic to the test method "bool XMLHttpRequest::urlMatchesDocumentDomain(const KURL& url) const" in /WebKit/WebCore/xml/XMLHttpRequest.cpp. 1342 1 ddkilzer 2007-08-28 10:00:02 -0700 <rdar://problem/5443521> 1341 2 ap 2007-08-28 10:44:01 -0700 Did this work in 10.4.x Safari/WebKit? If it did, this problem would be a P1, although I'm not quite sure what the correct fix would be. IIRC, the protocol<->port relationship is just a default that can be overridden via DNS, so it's not possible to know that https corresponds to port 443 without making a network connection. 1323 3 christian.mittendorf 2007-08-28 13:39:09 -0700 It's already a problem with 10.4.x, although Safari won't display a pop-up showing an error message (Access denied). It simply doesn't work. The error popup comes with Safari 3 Beta. 1324 4 christian.mittendorf 2007-08-28 13:46:01 -0700 (In reply to comment #2) > IIRC, the protocol<->port relationship is just a default that can be overridden via DNS, > so it's not possible to know that https corresponds to port 443 without making > a network connection. The DNS doesn't have anything to do with the protocol - port, the port being used is just a convention (see RFC 2616). 1322 5 christian.mittendorf 2007-08-28 13:56:26 -0700 There is also an interesting chapter entitled "3.2.3 URI Comparison" (http://www.faqs.org/rfcs/rfc2616.html) in RFC 2516 (HTTP/1.1): "A port that is empty or not given is equivalent to the default port for that URI-reference;" Even though W3C does not define how "constitutes as non same-origin" (http://www.w3.org/TR/XMLHttpRequest/) is defined, refering to RFC 2516 does in my eyes make sense. 1316 6 16149 christian.mittendorf 2007-08-28 15:19:01 -0700 Created attachment 16149 Added use of default http/https port for comparison if no port was specified in the url. 1310 7 ddkilzer 2007-08-28 15:45:37 -0700 (In reply to comment #6) > Created an attachment (id=16149) [edit] > Added use of default http/https port for comparison if no port was specified in > the url. Please set the "review?" flag if you would like this patch reviewed. Thanks! http://webkit.org/coding/contributing.html 1311 8 16149 darin 2007-08-28 16:01:20 -0700 Comment on attachment 16149 Added use of default http/https port for comparison if no port was specified in the url. Is this change really appropriate? Do other browsers consider this when comparing ports for security reasons? I'm not sure the actual port matters. All that matters is the security rule. The formatting is wrong (spaces before the url) and performance-wise we don't want to call lower multiple times on the same string. 1308 9 ap 2007-08-28 20:04:02 -0700 (In reply to comment #4) > The DNS doesn't have anything to do with the protocol - port, the port being > used is just a convention (see RFC 2616). Unfortunately, it's not that simple: per RFC 2782, this information is stored in SRV records. On the other hand, it's not clear if this RFC is ever going to be implemented. 1306 10 bzbarsky 2007-08-28 20:18:30 -0700 (In reply to comment #8) > Is this change really appropriate? Do other browsers consider this when > comparing ports for security reasons? The relevant code in Gecko is <http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/caps/src/nsScriptSecurityManager.cpp&rev=1.321&mark=326-328#319>. This is the code that is used for all same-origin checks (including cross-origin script access). 1302 11 16149 mjs 2007-08-28 20:55:22 -0700 Comment on attachment 16149 Added use of default http/https port for comparison if no port was specified in the url. I think we should match Mozilla and IE on this. Some technicalities about the current patch: 1) All these steps are done twice: + int document_port = documentURL.port(); + + if (document_port == 0) { + if(documentURL.protocol().lower() == "http") + document_port = 80; + if(documentURL.protocol().lower() == "https") + document_port = 443; + } It would be nice to factor this work out into a common function, especially so we can reuse it anywhere that an XSS same origin check is needed. Also, I'd suggest adding the default port for "ftp". And finally, we probably need to eventually add a way to ask the network layer for the default ports for various protocols. r- for these technicalities. I will gladly r+ a version that improves these things. I also asked Sam Weinig to look at this, to see if we can apply the same fix to scripting checks. 1297 12 sam 2007-08-28 21:21:58 -0700 A few comments on this itteration, Please capitalize the first word in the comment. + // make sure that the default http / https port 80 / 443 is used for comparison Our style dictates that these variables should be named documentPort and urlPort. + int document_port = documentURL.port(); + int url_port = url.port(); Please put a space after the if. This goes for a few other places as well. In addition, a slightly better way to do this comparison is to use the equalIgnoringCase(stringA, stringB) function. + if(documentURL.protocol().lower() == "http") If we make this change, we definitely need to make it in the isSafeScript check as well. 82884 13 21617 travis.vachon 2008-06-10 20:48:53 -0700 Created attachment 21617 Patch for better compliance with RFC 2616 Section 3.2.3 Take protocol default port into account when comparing URL ports. 82885 14 travis.vachon 2008-06-10 20:56:10 -0700 I've added a new patch, based on the original, rejected patch, to fix this bug. I'm not particularly fluent in C++, so please excuse any obvious mistakes. I'd also just like to add to this conversation by pointing out a real world bug caused in part by the current (unpatched) behavior: https://bugzilla.osafoundation.org/show_bug.cgi?id=12118 Bugs like this can be fairly subtle and difficult to track down, and can be particularly frustrating due to "correct" behavior in Firefox and IE. This is all to say that I'm personally invested in getting this patch included in trunk, so please don't hesitate to let me know how this process can be sped along. 82905 15 abarth 2008-06-11 00:24:41 -0700 > I've added a new patch, based on the original, rejected patch, to fix this bug. > I'm not particularly fluent in C++, so please excuse any obvious mistakes. We have some good technology for doing these kinds of comparisons. You should take the document's securityOrigin property and call it's isSameSchemeHostPort method to compare with the target URL (which you should parse into a SecurityOrigin). 82915 16 21617 sam 2008-06-11 00:30:41 -0700 Comment on attachment 21617 Patch for better compliance with RFC 2616 Section 3.2.3 This should be done with SecurityOrigins. I have a patch to change this. 83162 17 21672 abarth 2008-06-12 22:59:06 -0700 Created attachment 21672 Patch, Step 1: Clean up extra dependencies Saw some things worth changing while fixing this bug. Here's the first step. 83163 18 21673 abarth 2008-06-12 23:00:34 -0700 Created attachment 21673 Patch, Step 2: Test that we handle document.domain properly Step 2. We handle document.domain properly for XMLHttpRequest, but we don't have a test for it. Let's make sure we don't regress. 83164 19 21674 abarth 2008-06-12 23:02:08 -0700 Created attachment 21674 Patch, Step 3: Fix default ports This patch leverages our SecurityOrigin technology to get the default ports correct. 83171 20 21672 eric 2008-06-12 23:14:34 -0700 Comment on attachment 21672 Patch, Step 1: Clean up extra dependencies LGTM. 83172 21 21673 eric 2008-06-12 23:15:43 -0700 Comment on attachment 21673 Patch, Step 2: Test that we handle document.domain properly I don't really know the background here. This looks sane to me though. Best to let sam or mjs give the official r+. 83249 22 21673 darin 2008-06-13 14:09:19 -0700 Comment on attachment 21673 Patch, Step 2: Test that we handle document.domain properly r=me 83250 23 21674 darin 2008-06-13 14:10:37 -0700 Comment on attachment 21674 Patch, Step 3: Fix default ports r=me 83295 24 abarth 2008-06-13 23:53:52 -0700 Fixed in r34532. 16149 2007-08-28 15:19:01 -0700 2007-08-28 20:55:22 -0700 Added use of default http/https port for comparison if no port was specified in the url. XMLHttpRequest-patch.txt text/plain 1237 christian.mittendorf SW5kZXg6IFdlYkNvcmUveG1sL1hNTEh0dHBSZXF1ZXN0LmNwcAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJD b3JlL3htbC9YTUxIdHRwUmVxdWVzdC5jcHAJKHJldmlzaW9uIDI1Mjc5KQorKysgV2ViQ29yZS94 bWwvWE1MSHR0cFJlcXVlc3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zMDksOSArMzA5LDI4IEBA IGJvb2wgWE1MSHR0cFJlcXVlc3Q6OnVybE1hdGNoZXNEb2N1bWVudEQKIAogICAgIC8vIGJ1dCBh IHJlbW90ZSBkb2N1bWVudCBjYW4gb25seSBsb2FkIGZyb20gdGhlIHNhbWUgcG9ydCBvbiB0aGUg c2VydmVyCiAgICAgS1VSTCBkb2N1bWVudFVSTCA9IG1fZG9jLT5VUkwoKTsKKyAgICAKKyAgICAv LyBtYWtlIHN1cmUgdGhhdCB0aGUgZGVmYXVsdCBodHRwIC8gaHR0cHMgcG9ydCA4MCAvIDQ0MyBp cyB1c2VkIGZvciBjb21wYXJpc29uCisgICAgaW50IGRvY3VtZW50X3BvcnQgPSBkb2N1bWVudFVS TC5wb3J0KCk7CisgICAgaW50IHVybF9wb3J0ID0gdXJsLnBvcnQoKTsKKyAgICAKKyAgICBpZiAo ZG9jdW1lbnRfcG9ydCA9PSAwKSB7CisgICAgICAgIGlmKGRvY3VtZW50VVJMLnByb3RvY29sKCku bG93ZXIoKSA9PSAiaHR0cCIpCisgICAgICAgICAgICBkb2N1bWVudF9wb3J0ID0gODA7CisgICAg ICAgIGlmKGRvY3VtZW50VVJMLnByb3RvY29sKCkubG93ZXIoKSA9PSAiaHR0cHMiKQorICAgICAg ICAgICAgZG9jdW1lbnRfcG9ydCA9IDQ0MzsKKyAgICB9CisgICAgCisgICAgaWYgKHVybF9wb3J0 ID09IDApIHsKKyAgICAgICAgaWYodXJsLnByb3RvY29sKCkubG93ZXIoKSA9PSAiaHR0cCIpCisg ICAgICAgICAgICB1cmxfcG9ydCA9IDgwOworICAgICAgICBpZih1cmwucHJvdG9jb2woKS5sb3dl cigpID09ICJodHRwcyIpCisgICAgICAgICAgICB1cmxfcG9ydCA9IDQ0MzsKKyAgICB9CisgICAg CiAgICAgaWYgKGRvY3VtZW50VVJMLnByb3RvY29sKCkubG93ZXIoKSA9PSB1cmwucHJvdG9jb2wo KS5sb3dlcigpCiAgICAgICAgICAgICAmJiBkb2N1bWVudFVSTC5ob3N0KCkubG93ZXIoKSA9PSB1 cmwuaG9zdCgpLmxvd2VyKCkKLSAgICAgICAgICAgICYmIGRvY3VtZW50VVJMLnBvcnQoKSA9PSB1 cmwucG9ydCgpKQorICAgICAgICAgICAgJiYgZG9jdW1lbnRfcG9ydCA9PSB1cmxfcG9ydCkKICAg ICAgICAgcmV0dXJuIHRydWU7CiAKICAgICByZXR1cm4gZmFsc2U7Cg== 21617 2008-06-10 20:48:53 -0700 2008-06-11 00:30:41 -0700 Patch for better compliance with RFC 2616 Section 3.2.3 webkit_bug_151000.diff text/plain 1003 travis.vachon SW5kZXg6IFdlYkNvcmUveG1sL1hNTEh0dHBSZXF1ZXN0LmNwcAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJD b3JlL3htbC9YTUxIdHRwUmVxdWVzdC5jcHAJKHJldmlzaW9uIDM0NDg2KQorKysgV2ViQ29yZS94 bWwvWE1MSHR0cFJlcXVlc3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNDAsNiArMTQwLDE0IEBA CiAgICAgcmV0dXJuICFuYW1lLmNvbnRhaW5zKCdccicpICYmICFuYW1lLmNvbnRhaW5zKCdcbicp OwogfQogCitzdGF0aWMgYm9vbCBwb3J0TWF0Y2hlc1VybFBvcnQoY29uc3QgS1VSTCYgdXJsLCBp bnQgcG9ydCkKK3sKKyAgICByZXR1cm4gKHVybC5wb3J0KCkgPT0gcG9ydCkgfHwKKyAgICAgICAg KHVybC5wb3J0KCkgPT0gMCAmJiAKKyAgICAgICAgICAgKChlcXVhbElnbm9yaW5nQ2FzZSh1cmwu cHJvdG9jb2woKSwgImh0dHAiKSAmJiBwb3J0ID09IDgwKSB8fAorICAgICAgICAgICAgKGVxdWFs SWdub3JpbmdDYXNlKHVybC5wcm90b2NvbCgpLCAiaHR0cHMiKSAmJiBwb3J0ID09IDQ0MykpKTsK K30KKwogWE1MSHR0cFJlcXVlc3Q6OlhNTEh0dHBSZXF1ZXN0KERvY3VtZW50KiBkb2MpCiAgICAg OiBtX2RvYyhkb2MpCiAgICAgLCBtX2FzeW5jKHRydWUpCkBAIC0zMjcsNyArMzM1LDcgQEAKICAg ICBLVVJMIGRvY3VtZW50VVJMKG1fZG9jLT51cmwoKSk7CiAgICAgaWYgKGRvY3VtZW50VVJMLnBy b3RvY29sKCkubG93ZXIoKSA9PSB1cmwucHJvdG9jb2woKS5sb3dlcigpCiAgICAgICAgICAgICAm JiBkb2N1bWVudFVSTC5ob3N0KCkubG93ZXIoKSA9PSB1cmwuaG9zdCgpLmxvd2VyKCkKLSAgICAg ICAgICAgICYmIGRvY3VtZW50VVJMLnBvcnQoKSA9PSB1cmwucG9ydCgpKQorICAgICAgICAgICAg JiYgcG9ydE1hdGNoZXNVcmxQb3J0KGRvY3VtZW50VVJMLCB1cmwucG9ydCgpKSkKICAgICAgICAg cmV0dXJuIHRydWU7CiAKICAgICByZXR1cm4gZmFsc2U7Cg== 21672 2008-06-12 22:59:06 -0700 2008-06-12 23:14:34 -0700 Patch, Step 1: Clean up extra dependencies cleanup.patch text/plain 1202 abarth ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg MWJiZjIwNy4uN2I3NjMzYyAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAorMjAwOC0wNi0xMiAgQWRhbSBCYXJ0aCAg PGFiYXJ0aEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIFJlbW92ZWQgdW5uZWNlc3NhcnkgZGVwZW5kZW5jaWVzLgorCisgICAgICAg ICogcGxhdGZvcm0vU2VjdXJpdHlPcmlnaW4uY3BwOgorICAgICAgICAqIHBsYXRmb3JtL1NlY3Vy aXR5T3JpZ2luLmg6CisKIDIwMDgtMDYtMTIgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29t PgogCiAgICAgICAgIC0gdHJ5IHRvIGZpeCBXaW5kb3dzIGJ1aWxkCmRpZmYgLS1naXQgYS9XZWJD b3JlL3BsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmNwcCBiL1dlYkNvcmUvcGxhdGZvcm0vU2VjdXJp dHlPcmlnaW4uY3BwCmluZGV4IDY1MjA5MTEuLjY1ODkzNWMgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUv cGxhdGZvcm0vU2VjdXJpdHlPcmlnaW4uY3BwCisrKyBiL1dlYkNvcmUvcGxhdGZvcm0vU2VjdXJp dHlPcmlnaW4uY3BwCkBAIC0zMCwxMCArMzAsNyBAQAogI2luY2x1ZGUgIlNlY3VyaXR5T3JpZ2lu LmgiCiAKICNpbmNsdWRlICJDU3RyaW5nLmgiCi0jaW5jbHVkZSAiRG9jdW1lbnQuaCIKLSNpbmNs dWRlICJGcmFtZS5oIgogI2luY2x1ZGUgIkZyYW1lTG9hZGVyLmgiCi0jaW5jbHVkZSAiRnJhbWVU cmVlLmgiCiAjaW5jbHVkZSAiS1VSTC5oIgogI2luY2x1ZGUgIlBsYXRmb3JtU3RyaW5nLmgiCiAK ZGlmZiAtLWdpdCBhL1dlYkNvcmUvcGxhdGZvcm0vU2VjdXJpdHlPcmlnaW4uaCBiL1dlYkNvcmUv cGxhdGZvcm0vU2VjdXJpdHlPcmlnaW4uaAppbmRleCAyYjUyODhjLi5kMTU3ZTJiIDEwMDY0NAot LS0gYS9XZWJDb3JlL3BsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmgKKysrIGIvV2ViQ29yZS9wbGF0 Zm9ybS9TZWN1cml0eU9yaWdpbi5oCkBAIC0zNyw3ICszNyw2IEBACiAKIG5hbWVzcGFjZSBXZWJD b3JlIHsKIAotICAgIGNsYXNzIEZyYW1lOwogICAgIGNsYXNzIEtVUkw7CiAgICAgCiAgICAgY2xh c3MgU2VjdXJpdHlPcmlnaW4gOiBwdWJsaWMgVGhyZWFkU2FmZVNoYXJlZDxTZWN1cml0eU9yaWdp bj4gewo= 21673 2008-06-12 23:00:34 -0700 2008-06-13 14:09:19 -0700 Patch, Step 2: Test that we handle document.domain properly doc-domain.patch text/plain 1705 abarth ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCA5YjcxMTY3Li5iMzQ0OTYyIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMTQgQEAKIDIwMDgtMDYt MTIgIEFkYW0gQmFydGggIDxhYmFydGhAd2Via2l0Lm9yZz4KIAorICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0IHdoZXRoZXIgd2UgcGVybWl0IFhNTEh0 dHBSZXF1ZXN0IG9uY2UgZG9jdW1lbnQuZG9tYWluIGlzIHNldC4KKworICAgICAgICAqIGh0dHAv dGVzdHMveG1saHR0cHJlcXVlc3QvZG9jdW1lbnQtZG9tYWluLXNldC1leHBlY3RlZC50eHQ6IEFk ZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvZG9jdW1lbnQtZG9tYWlu LXNldC5odG1sOiBBZGRlZC4KKworMjAwOC0wNi0xMiAgQWRhbSBCYXJ0aCAgPGFiYXJ0aEB3ZWJr aXQub3JnPgorCiAgICAgICAgIFJ1YmJlcnN0YW1wZWQgYnkgTWFjaWVqLgogCiAgICAgICAgIEFk ZCB0aGUgZGF0YSB1cmwgdGVzdCBiYWNrIGFuZCBzZXQgbW9yZSBhZ3Jlc3NpdmUgQ2FjaGUtQ29u dHJvbCBoZWFkZXJzLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRw cmVxdWVzdC9kb2N1bWVudC1kb21haW4tc2V0LWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvZG9jdW1lbnQtZG9tYWluLXNldC1leHBlY3RlZC50eHQK bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uMTJmYTE2NAotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvZG9jdW1lbnQtZG9t YWluLXNldC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSw0IEBACitXYWl0aW5nLi4uCitQQVNTOiBY TUxIdHRwUmVxdWVzdCBhbGxvd2VkIHdpdGggZG9jdW1lbnQuZG9tYWluIHNldC4KKworCmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L2RvY3VtZW50LWRv bWFpbi1zZXQuaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvZG9j dW1lbnQtZG9tYWluLXNldC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAu LjEzZTAwYWYKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0 dHByZXF1ZXN0L2RvY3VtZW50LWRvbWFpbi1zZXQuaHRtbApAQCAtMCwwICsxLDE4IEBACis8aHRt bD4KKzxib2R5PgorPHByZT4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9s bGVyKQorICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CisKK2RvY3VtZW50LmRv bWFpbiA9ICcwLjAuMSc7CisKK2RvY3VtZW50LndyaXRlKCdXYWl0aW5nLi4uXG4nKTsKK3ZhciB4 aHIgPSBuZXcgWE1MSHR0cFJlcXVlc3QoKTsKK3hoci5vcGVuKCdQT1NUJywgJ3Jlc291cmNlcy9w b3N0LWVjaG8uY2dpJywgZmFsc2UpOworeGhyLnNlbmQoJ1BBU1M6IFhNTEh0dHBSZXF1ZXN0IGFs bG93ZWQgd2l0aCBkb2N1bWVudC5kb21haW4gc2V0LlxuJyk7Citkb2N1bWVudC53cml0ZSh4aHIu cmVzcG9uc2VUZXh0KTsKKzwvc2NyaXB0PgorPC9wcmU+Cis8L2JvZHk+Cis8L2h0bWw+Cg== 21674 2008-06-12 23:02:08 -0700 2008-06-13 14:10:37 -0700 Patch, Step 3: Fix default ports port.patch text/plain 5173 abarth ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg N2I3NjMzYy4uODg1ZjQwMyAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTIsNiArMiwyOSBAQAogCiAgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgogCisgICAgICAgIEZpeGVzIDxodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MTUxMDA+OgorICAgICAgICAgIFhNTEh0dHBSZXF1ZXN0Ojp1cmxNYXRj aGVzRG9jdW1lbnREb21haW4gcmFpc2VzIGVycm9yIGlmIHBvcnQKKyAgICAgICAgICBpbmZvcm1h dGlvbiBkb2VzIG5vdCBtYXRjaCBleGFjdGx5CisKKyAgICAgICAgUmVmYWN0b3Igb3VyIHNlY3Vy aXR5IGNoZWNrIGZvciBYTUxIdHRwUmVxdWVzdCBpbnRvIFNlY3VyaXR5T3JpZ2luIHNvCisgICAg ICAgIHdlIGNhbiByZXVzZSBpdCBpbiBvdGhlciBwbGFjZXMuICBUaGlzIGxldmVyYWdlcyBvdXIg ZGVmYXVsdCBwb3J0CisgICAgICAgIHRlY2hub2xvZ3kgaW4gU2VjdXJpdHlPcmlnaW4uCisKKyAg ICAgICAgSSB3YXNuJ3Qgc3VyZSBob3cgdG8gd3JpdGUgYSB0ZXN0IGZvciB0aGlzIGJlY2F1c2Ug dGhlIExheW91dFRlc3RzIHJ1bgorICAgICAgICBvbiBub24tZGVmYXVsdCBwb3J0cy4KKworICAg ICAgICAqIHBsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNl Y3VyaXR5T3JpZ2luOjpjYW5SZXF1ZXN0KToKKyAgICAgICAgKiBwbGF0Zm9ybS9TZWN1cml0eU9y aWdpbi5oOgorICAgICAgICAqIHhtbC9YTUxIdHRwUmVxdWVzdC5jcHA6CisgICAgICAgIChXZWJD b3JlOjpYTUxIdHRwUmVxdWVzdDo6c2VuZCk6CisgICAgICAgIChXZWJDb3JlOjpYTUxIdHRwUmVx dWVzdDo6d2lsbFNlbmRSZXF1ZXN0KToKKyAgICAgICAgKiB4bWwvWE1MSHR0cFJlcXVlc3QuaDoK KworMjAwOC0wNi0xMiAgQWRhbSBCYXJ0aCAgPGFiYXJ0aEB3ZWJraXQub3JnPgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCiAgICAgICAgIFJlbW92ZWQgdW5uZWNlc3Nh cnkgZGVwZW5kZW5jaWVzLgogCiAgICAgICAgICogcGxhdGZvcm0vU2VjdXJpdHlPcmlnaW4uY3Bw OgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9wbGF0Zm9ybS9TZWN1cml0eU9yaWdpbi5jcHAgYi9XZWJD b3JlL3BsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmNwcAppbmRleCA2NTg5MzVjLi5hZWYzYWUxIDEw MDY0NAotLS0gYS9XZWJDb3JlL3BsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmNwcAorKysgYi9XZWJD b3JlL3BsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmNwcApAQCAtMTUwLDYgKzE1MCwyMSBAQCBib29s IFNlY3VyaXR5T3JpZ2luOjpjYW5BY2Nlc3MoY29uc3QgU2VjdXJpdHlPcmlnaW4qIG90aGVyKSBj b25zdAogICAgIHJldHVybiBmYWxzZTsKIH0KIAorYm9vbCBTZWN1cml0eU9yaWdpbjo6Y2FuUmVx dWVzdChjb25zdCBLVVJMJiB1cmwpIGNvbnN0Cit7CisgICAgaWYgKEZyYW1lTG9hZGVyOjpzaG91 bGRUcmVhdFNjaGVtZUFzTG9jYWwobV9wcm90b2NvbCkpCisgICAgICAgIHJldHVybiB0cnVlOwor CisgICAgaWYgKG1fbm9BY2Nlc3MpCisgICAgICAgIHJldHVybiBmYWxzZTsKKworICAgIFJlZlB0 cjxTZWN1cml0eU9yaWdpbj4gdGFyZ2V0T3JpZ2luID0gU2VjdXJpdHlPcmlnaW46OmNyZWF0ZSh1 cmwpOworCisgICAgLy8gV2UgY2FsbCBpc1NhbWVTY2hlbWVIb3N0UG9ydCBoZXJlIGluc3RlYWQg b2YgY2FuQWNjZXNzIGJlY2F1c2Ugd2Ugd2FudAorICAgIC8vIHRvIGlnbm9yZSBkb2N1bWVudC5k b21haW4gZWZmZWN0cy4KKyAgICByZXR1cm4gaXNTYW1lU2NoZW1lSG9zdFBvcnQodGFyZ2V0T3Jp Z2luLmdldCgpKTsKK30KKwogYm9vbCBTZWN1cml0eU9yaWdpbjo6aXNTZWN1cmVUcmFuc2l0aW9u VG8oY29uc3QgS1VSTCYgdXJsKSBjb25zdAogeyAKICAgICAvLyBOZXcgd2luZG93IGNyZWF0ZWQg YnkgdGhlIGFwcGxpY2F0aW9uCmRpZmYgLS1naXQgYS9XZWJDb3JlL3BsYXRmb3JtL1NlY3VyaXR5 T3JpZ2luLmggYi9XZWJDb3JlL3BsYXRmb3JtL1NlY3VyaXR5T3JpZ2luLmgKaW5kZXggZDE1N2Uy Yi4uODk5MjY5NyAxMDA2NDQKLS0tIGEvV2ViQ29yZS9wbGF0Zm9ybS9TZWN1cml0eU9yaWdpbi5o CisrKyBiL1dlYkNvcmUvcGxhdGZvcm0vU2VjdXJpdHlPcmlnaW4uaApAQCAtNTQsNyArNTQsMTUg QEAgbmFtZXNwYWNlIFdlYkNvcmUgewogICAgICAgICBTdHJpbmcgZG9tYWluKCkgY29uc3QgeyBy ZXR1cm4gbV9kb21haW47IH0KICAgICAgICAgdW5zaWduZWQgc2hvcnQgcG9ydCgpIGNvbnN0IHsg cmV0dXJuIG1fcG9ydDsgfQogCisgICAgICAgIC8vIFJldHVybnMgdHJ1ZSBpZiB0aGlzIFNlY3Vy aXR5T3JpZ2luIGNhbiBzY3JpcHQgb2JqZWN0cyBpbiB0aGUgZ2l2ZW4KKyAgICAgICAgLy8gU2Vj dXJpdHlPcmlnaW4uCiAgICAgICAgIGJvb2wgY2FuQWNjZXNzKGNvbnN0IFNlY3VyaXR5T3JpZ2lu KikgY29uc3Q7CisKKyAgICAgICAgLy8gUmV0dXJucyB0cnVlIGlmIHRoaXMgU2VjdXJpdHlPcmln aW4gY2FuIHJlYWQgY29udGVudCByZXRyaWV2ZWQgZnJvbQorICAgICAgICAvLyB0aGUgZ2l2ZW4g VVJMLiBGb3IgZXhhbXBsZSwgY2FsbCB0aGlzIGZ1bmN0aW9uIGJlZm9yZSBpc3N1aW5nCisgICAg ICAgIC8vIFhNTEh0dHBSZXF1ZXN0cy4KKyAgICAgICAgYm9vbCBjYW5SZXF1ZXN0KGNvbnN0IEtV UkwmKSBjb25zdDsKKwogICAgICAgICBib29sIGlzU2VjdXJlVHJhbnNpdGlvblRvKGNvbnN0IEtV UkwmKSBjb25zdDsKIAogICAgICAgICBib29sIGlzRW1wdHkoKSBjb25zdDsKZGlmZiAtLWdpdCBh L1dlYkNvcmUveG1sL1hNTEh0dHBSZXF1ZXN0LmNwcCBiL1dlYkNvcmUveG1sL1hNTEh0dHBSZXF1 ZXN0LmNwcAppbmRleCA3NzE1NDdiLi5iYjlkNWI5IDEwMDY0NAotLS0gYS9XZWJDb3JlL3htbC9Y TUxIdHRwUmVxdWVzdC5jcHAKKysrIGIvV2ViQ29yZS94bWwvWE1MSHR0cFJlcXVlc3QuY3BwCkBA IC0zMTcsMjIgKzMxNyw2IEBAIHZvaWQgWE1MSHR0cFJlcXVlc3Q6OmNhbGxSZWFkeVN0YXRlQ2hh bmdlTGlzdGVuZXIoKQogICAgIH0KIH0KIAotYm9vbCBYTUxIdHRwUmVxdWVzdDo6dXJsTWF0Y2hl c0RvY3VtZW50RG9tYWluKGNvbnN0IEtVUkwmIHVybCkgY29uc3QKLXsKLSAgICAvLyBhIGxvY2Fs IGZpbGUgY2FuIGxvYWQgYW55dGhpbmcKLSAgICBpZiAobV9kb2MtPmlzQWxsb3dlZFRvTG9hZExv Y2FsUmVzb3VyY2VzKCkpCi0gICAgICAgIHJldHVybiB0cnVlOwotCi0gICAgLy8gYnV0IGEgcmVt b3RlIGRvY3VtZW50IGNhbiBvbmx5IGxvYWQgZnJvbSB0aGUgc2FtZSBwb3J0IG9uIHRoZSBzZXJ2 ZXIKLSAgICBLVVJMIGRvY3VtZW50VVJMKG1fZG9jLT51cmwoKSk7Ci0gICAgaWYgKGRvY3VtZW50 VVJMLnByb3RvY29sKCkubG93ZXIoKSA9PSB1cmwucHJvdG9jb2woKS5sb3dlcigpCi0gICAgICAg ICAgICAmJiBkb2N1bWVudFVSTC5ob3N0KCkubG93ZXIoKSA9PSB1cmwuaG9zdCgpLmxvd2VyKCkK LSAgICAgICAgICAgICYmIGRvY3VtZW50VVJMLnBvcnQoKSA9PSB1cmwucG9ydCgpKQotICAgICAg ICByZXR1cm4gdHJ1ZTsKLQotICAgIHJldHVybiBmYWxzZTsKLX0KLQogdm9pZCBYTUxIdHRwUmVx dWVzdDo6b3Blbihjb25zdCBTdHJpbmcmIG1ldGhvZCwgY29uc3QgS1VSTCYgdXJsLCBib29sIGFz eW5jLCBFeGNlcHRpb25Db2RlJiBlYykKIHsKICAgICBpbnRlcm5hbEFib3J0KCk7CkBAIC00MTAs NyArMzk0LDcgQEAgdm9pZCBYTUxIdHRwUmVxdWVzdDo6c2VuZChjb25zdCBTdHJpbmcmIGJvZHks IEV4Y2VwdGlvbkNvZGUmIGVjKQogCiAgICAgbV9lcnJvciA9IGZhbHNlOwogCi0gICAgbV9zYW1l T3JpZ2luUmVxdWVzdCA9IHVybE1hdGNoZXNEb2N1bWVudERvbWFpbihtX3VybCk7CisgICAgbV9z YW1lT3JpZ2luUmVxdWVzdCA9IG1fZG9jLT5zZWN1cml0eU9yaWdpbigpLT5jYW5SZXF1ZXN0KG1f dXJsKTsKIAogICAgIFJlc291cmNlUmVxdWVzdCByZXF1ZXN0OwogICAgIGlmIChtX3NhbWVPcmln aW5SZXF1ZXN0KQpAQCAtODkzLDcgKzg3Nyw3IEBAIHZvaWQgWE1MSHR0cFJlcXVlc3Q6OmRpZEZp bmlzaExvYWRpbmdNZXRob2RDaGVjayhTdWJyZXNvdXJjZUxvYWRlciogbG9hZGVyKQogdm9pZCBY TUxIdHRwUmVxdWVzdDo6d2lsbFNlbmRSZXF1ZXN0KFN1YnJlc291cmNlTG9hZGVyKiwgUmVzb3Vy Y2VSZXF1ZXN0JiByZXF1ZXN0LCBjb25zdCBSZXNvdXJjZVJlc3BvbnNlJiByZWRpcmVjdFJlc3Bv bnNlKQogewogICAgIC8vIEZJWE1FOiBUaGlzIG5lZWRzIHRvIGJlIGZpeGVkIHRvIGZvbGxvdyB0 aGUgcmVkaXJlY3QgY29ycmVjdGx5IGV2ZW4gZm9yIGNyb3NzLWRvbWFpbiByZXF1ZXN0cy4KLSAg ICBpZiAoIXVybE1hdGNoZXNEb2N1bWVudERvbWFpbihyZXF1ZXN0LnVybCgpKSkKKyAgICBpZiAo IW1fZG9jLT5zZWN1cml0eU9yaWdpbigpLT5jYW5SZXF1ZXN0KHJlcXVlc3QudXJsKCkpKQogICAg ICAgICBpbnRlcm5hbEFib3J0KCk7CiB9CiAKZGlmZiAtLWdpdCBhL1dlYkNvcmUveG1sL1hNTEh0 dHBSZXF1ZXN0LmggYi9XZWJDb3JlL3htbC9YTUxIdHRwUmVxdWVzdC5oCmluZGV4IDNmZTNkOGMu LjhjZmEwMzggMTAwNjQ0Ci0tLSBhL1dlYkNvcmUveG1sL1hNTEh0dHBSZXF1ZXN0LmgKKysrIGIv V2ViQ29yZS94bWwvWE1MSHR0cFJlcXVlc3QuaApAQCAtOTQsOCArOTQsNiBAQCBwcml2YXRlOgog ICAgIHZpcnR1YWwgdm9pZCByZWZFdmVudFRhcmdldCgpIHsgcmVmKCk7IH0KICAgICB2aXJ0dWFs IHZvaWQgZGVyZWZFdmVudFRhcmdldCgpIHsgZGVyZWYoKTsgfQogCi0gICAgYm9vbCB1cmxNYXRj aGVzRG9jdW1lbnREb21haW4oY29uc3QgS1VSTCYpIGNvbnN0OwotCiAgICAgdmlydHVhbCB2b2lk IHdpbGxTZW5kUmVxdWVzdChTdWJyZXNvdXJjZUxvYWRlciosIFJlc291cmNlUmVxdWVzdCYgcmVx dWVzdCwgY29uc3QgUmVzb3VyY2VSZXNwb25zZSYgcmVkaXJlY3RSZXNwb25zZSk7CiAgICAgdmly dHVhbCB2b2lkIGRpZFJlY2VpdmVSZXNwb25zZShTdWJyZXNvdXJjZUxvYWRlciosIGNvbnN0IFJl c291cmNlUmVzcG9uc2UmKTsKICAgICB2aXJ0dWFsIHZvaWQgZGlkUmVjZWl2ZURhdGEoU3VicmVz b3VyY2VMb2FkZXIqLCBjb25zdCBjaGFyKiBkYXRhLCBpbnQgc2l6ZSk7Cg==