From c1da4caeabcbc07c6969e06c3c02c4ef409889cb Mon Sep 17 00:00:00 2001
From: Jean-Pierre Huynh <jean-pierre.huynh@alfresco.com>
Date: Thu, 5 May 2016 14:35:14 +0000
Subject: [PATCH] MNT-16255: Merged 5.0.N (5.0.4) to 5.1.N (5.1.2)    126142
 jphuynh: MNT-16254: Merged V4.2-BUG-FIX (4.2.7) to 5.0.N (5.0.4)       126140
 jphuynh: MNT-16253: Disable the vulnerable ImageMagick coders in policy.xml. 
         - This commit will be merged to all HF branches so that it will be
 included in all future HFs.

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/BRANCHES/DEV/5.1.N/root@126144 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
---
 src/main/resources/bitrock/imagemagick.xml | 30 +++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/src/main/resources/bitrock/imagemagick.xml b/src/main/resources/bitrock/imagemagick.xml
index 7287699b44..f3bfbaa46a 100644
--- a/src/main/resources/bitrock/imagemagick.xml
+++ b/src/main/resources/bitrock/imagemagick.xml
@@ -283,6 +283,34 @@ export GS_LIB
             </actionList>
         </folder>
     </folderList>
-    <postInstallationActionList/>
+    <postInstallationActionList>
+        <!-- ImageMagick: Remote execution vulnerability (CVE-2016–3714) -->
+        <if>
+            <conditionRuleList>
+                <platformTest type="unix"/>
+            </conditionRuleList>
+            <actionList>
+                <setInstallerVariable name="imagemagick_policy_path" value="${imagemagick_root_directory}/lib/ImageMagick-${imagemagick_version}/config/policy.xml"/>
+            </actionList>
+            <elseActionList>
+                <setInstallerVariable name="imagemagick_policy_path" value="${imagemagick_root_directory}/policy.xml"/>
+            </elseActionList>
+        </if>
+        <substitute>
+            <files>${imagemagick_policy_path}</files>
+            <substitutionList>
+                <substitution>
+                    <pattern><![CDATA[<policymap>]]></pattern>
+                    <value><![CDATA[<policymap>
+    <policy domain="coder" rights="none" pattern="EPHEMERAL" />
+    <policy domain="coder" rights="none" pattern="URL" />
+    <policy domain="coder" rights="none" pattern="HTTPS" />
+    <policy domain="coder" rights="none" pattern="MVG" />
+    <policy domain="coder" rights="none" pattern="MSL" />
+    ]]></value>
+                </substitution>
+            </substitutionList>
+        </substitute>
+    </postInstallationActionList>
 </component>