<img alt="Liferay" height="36" src="http://cdn.www.liferay.com/osb-www-theme/images/custom/heading.png" width="146" />

The work the CST is doing is critical and I appreciate their hard work. However, I am wondering if others have been able to successfully apply the cumulative source patch for CE GA1?

I have attempted to use both 'patch' and 'git apply' as outlined at http://www.liferay.com/community/security-team/cst-process#patchinfo but without success. I am getting the following output when using 'patch' against a new download of the GA1 source:

  1
  2ksperow@localhost liferay-portal-src-6.1.0-ce-ga1]$ patch --dry-run -p1 < ~/Downloads/6.1.0-ga1...6.1.0-cumulative.patch
  3patching file portal-impl/src/com/liferay/portlet/documentlibrary/store/DLStoreImpl.java
  4Hunk #1 FAILED at 216.
  5Hunk #2 FAILED at 224.
  6Hunk #3 FAILED at 231.
  7Hunk #4 FAILED at 239.
  8Hunk #5 FAILED at 247.
  9Hunk #6 FAILED at 255.
10Hunk #7 FAILED at 263.
11Hunk #8 FAILED at 276.
12Hunk #9 FAILED at 290.
139 out of 9 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portlet/documentlibrary/store/DLStoreImpl.java.rej
14patching file portal-impl/src/com/liferay/portal/util/FileImpl.java
15Hunk #1 FAILED at 406.
161 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/util/FileImpl.java.rej
17patching file portal-impl/src/com/liferay/portal/service/http/GroupServiceHttp.java
18Hunk #1 FAILED at 611.
19Hunk #2 FAILED at 625.
202 out of 2 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/http/GroupServiceHttp.java.rej
21patching file portal-impl/src/com/liferay/portal/service/http/OrganizationServiceHttp.java
22Hunk #1 FAILED at 353.
23Hunk #2 FAILED at 367.
242 out of 2 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/http/OrganizationServiceHttp.java.rej
25patching file portal-impl/src/com/liferay/portal/service/http/UserGroupServiceHttp.java
26Hunk #1 FAILED at 264.
27Hunk #2 FAILED at 277.
282 out of 2 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/http/UserGroupServiceHttp.java.rej
29patching file portal-impl/src/com/liferay/portal/service/http/UserServiceHttp.java
30Hunk #1 FAILED at 903.
31Hunk #2 FAILED at 917.
32Hunk #3 FAILED at 934.
33Hunk #4 FAILED at 948.
344 out of 4 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/http/UserServiceHttp.java.rej
35patching file portal-impl/src/com/liferay/portal/service/impl/GroupServiceImpl.java
36Hunk #1 FAILED at 36.
37Hunk #2 FAILED at 537.
38Hunk #3 FAILED at 632.
39Hunk #4 FAILED at 650.
404 out of 4 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/impl/GroupServiceImpl.java.rej
41patching file portal-impl/src/com/liferay/portal/service/impl/OrganizationServiceImpl.java
42Hunk #1 FAILED at 36.
43Hunk #2 FAILED at 359.
44Hunk #3 FAILED at 439.
45Hunk #4 FAILED at 545.
46Hunk #5 FAILED at 600.
475 out of 5 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/impl/OrganizationServiceImpl.java.rej
48patching file portal-impl/src/com/liferay/portal/service/impl/RoleServiceImpl.java
49Hunk #1 FAILED at 23.
50Hunk #2 FAILED at 176.
51Hunk #3 FAILED at 194.
52Hunk #4 FAILED at 211.
53Hunk #5 FAILED at 227.
54Hunk #6 FAILED at 251.
55Hunk #7 FAILED at 274.
567 out of 7 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/impl/RoleServiceImpl.java.rej
57patching file portal-impl/src/com/liferay/portal/service/impl/UserGroupServiceImpl.java
58Hunk #1 FAILED at 24.
59Hunk #2 FAILED at 169.
60Hunk #3 FAILED at 235.
613 out of 3 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/impl/UserGroupServiceImpl.java.rej
62patching file portal-impl/src/com/liferay/portal/service/impl/UserServiceImpl.java
63Hunk #1 FAILED at 28.
64Hunk #2 FAILED at 36.
65Hunk #3 FAILED at 777.
66Hunk #4 FAILED at 794.
67Hunk #5 FAILED at 807.
68Hunk #6 FAILED at 822.
69Hunk #7 FAILED at 846.
70Hunk #8 FAILED at 1199.
71Hunk #9 FAILED at 1399.
72Hunk #10 FAILED at 1502.
73Hunk #11 FAILED at 1547.
74Hunk #12 FAILED at 1686.
7512 out of 12 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/impl/UserServiceImpl.java.rej
76patching file portal-service/src/com/liferay/portal/service/GroupService.java
77Hunk #1 FAILED at 355.
781 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/GroupService.java.rej
79patching file portal-service/src/com/liferay/portal/service/GroupServiceUtil.java
80Hunk #1 FAILED at 372.
811 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/GroupServiceUtil.java.rej
82patching file portal-service/src/com/liferay/portal/service/GroupServiceWrapper.java
83patching file portal-service/src/com/liferay/portal/service/OrganizationService.java
84Hunk #1 FAILED at 229.
851 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/OrganizationService.java.rej
86patching file portal-service/src/com/liferay/portal/service/OrganizationServiceUtil.java
87Hunk #1 FAILED at 245.
881 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/OrganizationServiceUtil.java.rej
89patching file portal-service/src/com/liferay/portal/service/OrganizationServiceWrapper.java
90patching file portal-service/src/com/liferay/portal/service/UserGroupService.java
91Hunk #1 FAILED at 144.
921 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/UserGroupService.java.rej
93patching file portal-service/src/com/liferay/portal/service/UserGroupServiceUtil.java
94Hunk #1 FAILED at 148.
951 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/UserGroupServiceUtil.java.rej
96patching file portal-service/src/com/liferay/portal/service/UserGroupServiceWrapper.java
97patching file portal-service/src/com/liferay/portal/service/UserService.java
98Hunk #1 FAILED at 588.
99Hunk #2 FAILED at 601.
1002 out of 2 hunks FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/UserService.java.rej
101patching file portal-service/src/com/liferay/portal/service/UserServiceUtil.java
102Hunk #1 FAILED at 641.
103Hunk #2 FAILED at 655.
1042 out of 2 hunks FAILED -- saving rejects to file portal-service/src/com/liferay/portal/service/UserServiceUtil.java.rej
105patching file portal-service/src/com/liferay/portal/service/UserServiceWrapper.java
106patching file portal-impl/src/com/liferay/portlet/PortletRequestDispatcherImpl.java
107Hunk #1 FAILED at 282.
1081 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/com/liferay/portlet/PortletRequestDispatcherImpl.java.rej
109patching file portal-impl/src/com/liferay/portlet/StrutsPortlet.java
110Hunk #1 FAILED at 16.
111Hunk #2 FAILED at 156.
112Hunk #3 FAILED at 204.
113Hunk #4 FAILED at 219.
114Hunk #5 FAILED at 267.
1155 out of 5 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portlet/StrutsPortlet.java.rej
116patching file portal-web/docroot/WEB-INF/liferay-web.xml
117Hunk #1 FAILED at 1103.
1181 out of 1 hunk FAILED -- saving rejects to file portal-web/docroot/WEB-INF/liferay-web.xml.rej
119patching file portal-web/docroot/WEB-INF/portlet-custom.xml
120Hunk #1 FAILED at 6.
121Hunk #2 FAILED at 24.
122Hunk #3 FAILED at 51.
123Hunk #4 FAILED at 71.
124Hunk #5 FAILED at 108.
125Hunk #6 FAILED at 132.
126Hunk #7 FAILED at 160.
127Hunk #8 FAILED at 197.
128Hunk #9 FAILED at 247.
129Hunk #10 FAILED at 273.
130Hunk #11 FAILED at 293.
131Hunk #12 FAILED at 313.
132Hunk #13 FAILED at 333.
133Hunk #14 FAILED at 357.
134Hunk #15 FAILED at 380.
135Hunk #16 FAILED at 400.
136Hunk #17 FAILED at 424.
137Hunk #18 FAILED at 454.
138Hunk #19 FAILED at 484.
139Hunk #20 FAILED at 508.
140Hunk #21 FAILED at 538.
141Hunk #22 FAILED at 596.
142Hunk #23 FAILED at 643.
143Hunk #24 FAILED at 694.
144Hunk #25 FAILED at 718.
145Hunk #26 FAILED at 748.
146Hunk #27 FAILED at 775.
147Hunk #28 FAILED at 795.
148Hunk #29 FAILED at 819.
149Hunk #30 FAILED at 839.
150Hunk #31 FAILED at 978.
151Hunk #32 FAILED at 1009.
152Hunk #33 FAILED at 1033.
153Hunk #34 FAILED at 1060.
154Hunk #35 FAILED at 1087.
155Hunk #36 FAILED at 1114.
156Hunk #37 FAILED at 1137.
157Hunk #38 FAILED at 1157.
158Hunk #39 FAILED at 1181.
159Hunk #40 FAILED at 1203.
160Hunk #41 FAILED at 1214.
161Hunk #42 FAILED at 1228.
162Hunk #43 FAILED at 1244.
163Hunk #44 FAILED at 1255.
164Hunk #45 FAILED at 1281.
165Hunk #46 FAILED at 1301.
166Hunk #47 FAILED at 1322.
167Hunk #48 FAILED at 1346.
168Hunk #49 FAILED at 1376.
169Hunk #50 FAILED at 1409.
170Hunk #51 FAILED at 1426.
171Hunk #52 FAILED at 1446.
172Hunk #53 FAILED at 1470.
173Hunk #54 FAILED at 1511.
174Hunk #55 FAILED at 1528.
175Hunk #56 FAILED at 1546.
176Hunk #57 FAILED at 1573.
177Hunk #58 FAILED at 1596.
178Hunk #59 FAILED at 1623.
179Hunk #60 FAILED at 1645.
180Hunk #61 FAILED at 1666.
181Hunk #62 FAILED at 1693.
182Hunk #63 FAILED at 1717.
183Hunk #64 FAILED at 1728.
184Hunk #65 FAILED at 1745.
185Hunk #66 FAILED at 1762.
186Hunk #67 FAILED at 1779.
187Hunk #68 FAILED at 1796.
188Hunk #69 FAILED at 1813.
189Hunk #70 FAILED at 1830.
190Hunk #71 FAILED at 1847.
191Hunk #72 FAILED at 1861.
192Hunk #73 FAILED at 1878.
193Hunk #74 FAILED at 1895.
194Hunk #75 FAILED at 1912.
195Hunk #76 FAILED at 1929.
196Hunk #77 FAILED at 1943.
197Hunk #78 FAILED at 1961.
198Hunk #79 FAILED at 1986.
199Hunk #80 FAILED at 2009.
200Hunk #81 FAILED at 2032.
201Hunk #82 FAILED at 2055.
202Hunk #83 FAILED at 2075.
203Hunk #84 FAILED at 2092.
204Hunk #85 FAILED at 2113.
205Hunk #86 FAILED at 2160.
206Hunk #87 FAILED at 2177.
207Hunk #88 FAILED at 2194.
208Hunk #89 FAILED at 2211.
209Hunk #90 FAILED at 2231.
210Hunk #91 FAILED at 2255.
211Hunk #92 FAILED at 2272.
212Hunk #93 FAILED at 2286.
213Hunk #94 FAILED at 2306.
214Hunk #95 FAILED at 2326.
215Hunk #96 FAILED at 2340.
216Hunk #97 FAILED at 2357.
217Hunk #98 FAILED at 2378.
218Hunk #99 FAILED at 2401.
219Hunk #100 FAILED at 2415.
220Hunk #101 FAILED at 2439.
221Hunk #102 FAILED at 2467.
222Hunk #103 FAILED at 2487.
223Hunk #104 FAILED at 2507.
224Hunk #105 FAILED at 2534.
225Hunk #106 FAILED at 2574.
226Hunk #107 FAILED at 2595.
227Hunk #108 FAILED at 2631.
228Hunk #109 FAILED at 2648.
229Hunk #110 FAILED at 2668.
230Hunk #111 FAILED at 2688.
231Hunk #112 FAILED at 2709.
232Hunk #113 FAILED at 2766.
233113 out of 113 hunks FAILED -- saving rejects to file portal-web/docroot/WEB-INF/portlet-custom.xml.rej
234patching file util-bridges/src/com/liferay/util/bridges/mvc/MVCPortlet.java
235Hunk #1 FAILED at 282.
2361 out of 1 hunk FAILED -- saving rejects to file util-bridges/src/com/liferay/util/bridges/mvc/MVCPortlet.java.rej
237patching file portal-impl/src/com/liferay/portal/action/JSONServiceAction.java
238Hunk #1 FAILED at 30.
239Hunk #2 FAILED at 49.
240Hunk #3 FAILED at 79.
241Hunk #4 FAILED at 139.
2424 out of 4 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/action/JSONServiceAction.java.rej
243patching file portal-impl/src/com/liferay/portal/jsonwebservice/JSONWebServiceActionImpl.java
244patching file portal-impl/src/com/liferay/portal/jsonwebservice/JSONWebServiceServiceAction.java
245patching file portal-impl/src/com/liferay/portal/service/impl/UserServiceImpl.java
246Hunk #1 FAILED at 556.
247Hunk #2 FAILED at 1166.
248Hunk #3 FAILED at 1603.
249Hunk #4 FAILED at 1624.
250Hunk #5 FAILED at 1636.
251Hunk #6 FAILED at 1669.
252Hunk #7 FAILED at 1707.
253Hunk #8 FAILED at 1747.
254Hunk #9 FAILED at 1788.
2559 out of 9 hunks FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/service/impl/UserServiceImpl.java.rej
256patching file portal-impl/src/com/liferay/portal/util/PropsValues.java
257Hunk #1 FAILED at 724.
2581 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/util/PropsValues.java.rej
259patching file portal-impl/src/portal.properties
260Hunk #1 FAILED at 5500.
2611 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/portal.properties.rej
262patching file portal-service/src/com/liferay/portal/kernel/jsonwebservice/JSONWebServiceAction.java
263patching file portal-service/src/com/liferay/portal/kernel/util/PropsKeys.java
264Hunk #1 FAILED at 991.
2651 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/kernel/util/PropsKeys.java.rej
266patching file portal-impl/src/com/liferay/portal/action/JSONServiceAction.java
267Hunk #1 FAILED at 403.
2681 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/action/JSONServiceAction.java.rej
269patching file portal-impl/src/com/liferay/portal/json/JSONDeserializerImpl.java
270patching file portal-impl/src/com/liferay/portal/json/PortalBeanObjectFactory.java
271patching file portal-impl/src/com/liferay/portal/jsonwebservice/JSONWebServiceActionImpl.java
272Hunk #1 succeeded at 82 (offset -5 lines).
273Hunk #2 succeeded at 140 (offset -5 lines).
274Hunk #3 succeeded at 250 (offset -5 lines).
275patching file portal-impl/src/com/liferay/portal/util/PropsValues.java
276Hunk #1 FAILED at 722.
2771 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/com/liferay/portal/util/PropsValues.java.rej
278patching file portal-impl/src/portal.properties
279Hunk #1 FAILED at 5489.
2801 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/portal.properties.rej
281patching file portal-service/src/com/liferay/portal/kernel/util/PropsKeys.java
282Hunk #1 FAILED at 989.
2831 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portal/kernel/util/PropsKeys.java.rej
284patching file portal-impl/src/com/liferay/portlet/wiki/service/impl/WikiPageLocalServiceImpl.java
285Hunk #1 FAILED at 587.
2861 out of 1 hunk FAILED -- saving rejects to file portal-impl/src/com/liferay/portlet/wiki/service/impl/WikiPageLocalServiceImpl.java.rej
287patching file portal-service/src/com/liferay/portal/kernel/util/TempFileNameException.java
288patching file portal-service/src/com/liferay/portal/kernel/util/TempFileUtil.java
289patching file portal-service/src/com/liferay/portlet/wiki/service/WikiPageLocalService.java
290Hunk #1 FAILED at 340.
2911 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portlet/wiki/service/WikiPageLocalService.java.rej
292patching file portal-service/src/com/liferay/portlet/wiki/service/WikiPageLocalServiceUtil.java
293Hunk #1 FAILED at 420.
2941 out of 1 hunk FAILED -- saving rejects to file portal-service/src/com/liferay/portlet/wiki/service/WikiPageLocalServiceUtil.java.rej
295patching file portal-service/src/com/liferay/portlet/wiki/service/WikiPageLocalServiceWrapper.java

Am I missing something basic? Any feedback is appreciated.

Thanks,
Ken

RE: Security Source Patches

9 de Agosto de 2012 18:11

Resposta

Ranking: Liferay Legend

Mensagens: 8000

Data de entrada: 23 de Março de 2010

Yes, the patches were created on Linux system. You'll have to strip the CR from the patch and liferay source code.

Marcar como resposta

RE: Security Source Patches

9 de Agosto de 2012 18:15

Resposta

David H Nebinger

Ranking: Liferay Legend

Mensagens: 4496

Data de entrada: 1 de Setembro de 2006

Hitoshi Ozawa:

Yes, the patches were created on Linux system. You'll have to strip the CR from the patch and liferay source code.

Or upgrade your operating system emoticon

Marcar como resposta

RE: Security Source Patches

9 de Agosto de 2012 19:44

Resposta

Ranking: Liferay Legend

Mensagens: 8000

Data de entrada: 23 de Março de 2010

Or just run the script described in the following page. Liferay.com should do something about this to keep the source nice and neat.

http://www.wiredrevolution.com/bash-programming/convert-text-files-within-a-directory-from-windows-to-unix-format

Marcar como resposta

RE: Security Source Patches

10 de Agosto de 2012 05:41

Resposta

LIFERAY STAFF

Ranking: Liferay Master

Mensagens: 975

Data de entrada: 17 de Setembro de 2010

Hitoshi Ozawa:

Thanks guys, this is definitely a problem - I'll update the CST docs.

Marcar como resposta

RE: Security Source Patches

10 de Agosto de 2012 08:26

Resposta

LIFERAY STAFF

Ranking: Liferay Master

Mensagens: 975

Data de entrada: 17 de Setembro de 2010

James Falkner:

Hitoshi Ozawa:

Thanks guys, this is definitely a problem - I'll update the CST docs.

Ok I updated the docs on the CST page. You can use patch -p1 --binary < patchfile as a workaround (I tested this on Windows and Ubuntu). Mac doesn't seem to need it. If you find other oddities, let us know!

Marcar como resposta

RE: Security Source Patches

10 de Agosto de 2012 19:57

Resposta

Ranking: Liferay Legend

Mensagens: 8000

Data de entrada: 23 de Março de 2010

Are the patch files made with the --binary options because some files in liferay source are in LF while others are in CR+LF. It really gets more complicated if a user made some changes (example: opening a CR+LF file in Ubuntu and saved the file without making any textual changes may save the file in LF.)

Another question is, are you testing these patches with the liferay 6.1.0 CE source file download?

Marcar como resposta

RE: Security Source Patches

10 de Agosto de 2012 23:11

Resposta

Ranking: Liferay Legend

Mensagens: 8000

Data de entrada: 23 de Março de 2010

I just tested the patches and everything seems to work except for the following 2 patches. I think the problem is patches are each created from the unchanged master source instead of the patches source. That is, if the file is patched by multiple LPS's, the row number in the patch is only going to be correct in the first patch.
LPS-26940 and LSP-28934

I've use the Liferay 6.1.0 GA1 source code available from the download site (not the github nor svn).
patch -p1 --dry-run < *.patch

Some of the line number are matching so they need to be adjusted to make the command work. I've applied the patches in the order listed in the security page:
LPS-27726
LPS-26935
LPS-26940
LPS-28309
LPS-28358
LPS-26930
LPS-28423
LPS-28836
LPS-28934

EDIT: seems like the patch is deleting some necessary rows.

Marcar como resposta

RE: Security Source Patches

13 de Agosto de 2012 09:03

Resposta

LIFERAY STAFF

Ranking: Liferay Master

Mensagens: 975

Data de entrada: 17 de Setembro de 2010

Hitoshi Ozawa:

yeah that's probably the case. If you want all the patches, then best go with the cumulative source patch. We don't test all of the possible combinations of individual patches. We do a best effort test of the cumulative patch. I'll add this to the CST information page.

Marcar como resposta

RE: Security Source Patches

13 de Agosto de 2012 09:16

Resposta

LIFERAY STAFF

Ranking: Liferay Master

Mensagens: 975

Data de entrada: 17 de Setembro de 2010

James Falkner:

Hitoshi Ozawa:

Thanks guys, this is definitely a problem - I'll update the CST docs.

BTW, I was wrong: --binary does absolutely nothing to help here on Linux emoticon

I was testing using the Github source bundle, which has no issues. It is the SourceForge source bundle that is the problem. That is the one where the line endings on the source files themselves need to be converted before the patch will apply. I've updated the CST docs! And we are checking to see what can be done about SourceForge.

Marcar como resposta

RE: Security Source Patches

13 de Agosto de 2012 10:20

Resposta

Ken Sperow

Ranking: New Member

Mensagens: 5

Data de entrada: 25 de Abril de 2011

Thank you for the updated instructions within the CST process page. We do all our work within Linux and I had not been bitten by the Windows CR issue in a number of years (dos2unix is your friend). With GA2 now released we are using it, but it is only a matter of time before another security issue is identified and fixed.

Thank you to the CST.
Ken