From 30fbe9255f18dbf08323ecf0449d454f4adde352 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 3 Dec 2022 16:18:45 +0100
Subject: [PATCH] pgadmin4: apply patch for CVE-2022-4223

Version 6.16 [0] seems quite large in term of changes so I preferred to only backport
the security fix.

[0] https://www.pgadmin.org/docs/pgadmin4/development/release_notes_6_16.html
---
 pkgs/tools/admin/pgadmin/CVE-2022-4223.patch | 56 ++++++++++++++++++++
 pkgs/tools/admin/pgadmin/default.nix         |  1 +
 2 files changed, 57 insertions(+)
 create mode 100644 pkgs/tools/admin/pgadmin/CVE-2022-4223.patch

diff --git a/pkgs/tools/admin/pgadmin/CVE-2022-4223.patch b/pkgs/tools/admin/pgadmin/CVE-2022-4223.patch
new file mode 100644
index 000000000000..688a61565b9a
--- /dev/null
+++ b/pkgs/tools/admin/pgadmin/CVE-2022-4223.patch
@@ -0,0 +1,56 @@
+From 9d30dd3857661d110ad8a50024b276148fd64cb6 Mon Sep 17 00:00:00 2001
+From: Akshay Joshi <akshay.joshi@enterprisedb.com>
+Date: Wed, 30 Nov 2022 12:02:45 +0530
+Subject: [PATCH] Ensure that only authorized and authenticated users can
+ validate binary paths (CVE-2022-4223). #5593
+
+(cherry picked from commit 461849c2763e680ed2296bb8a753ca7aef546595)
+---
+ web/pgadmin/misc/__init__.py | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/web/pgadmin/misc/__init__.py b/web/pgadmin/misc/__init__.py
+index 7f6a783fb..2fae3fc4e 100644
+--- a/web/pgadmin/misc/__init__.py
++++ b/web/pgadmin/misc/__init__.py
+@@ -10,8 +10,9 @@
+ """A blueprint module providing utility functions for the application."""
+ 
+ import pgadmin.utils.driver as driver
+-from flask import url_for, render_template, Response, request
++from flask import url_for, render_template, Response, request, current_app
+ from flask_babel import gettext
++from flask_security import login_required
+ from pgadmin.utils import PgAdminModule, replace_binary_path
+ from pgadmin.utils.csrf import pgCSRFProtect
+ from pgadmin.utils.session import cleanup_session_files
+@@ -192,13 +193,14 @@ def shutdown():
+ ##########################################################################
+ # A special URL used to validate the binary path
+ ##########################################################################
++@login_required
+ @blueprint.route("/validate_binary_path",
+                  endpoint="validate_binary_path",
+                  methods=["POST"])
+ def validate_binary_path():
+     """
+     This function is used to validate the specified utilities path by
+-    running the utilities with there versions.
++    running the utilities with their versions.
+     """
+     data = None
+     if hasattr(request.data, 'decode'):
+@@ -219,6 +221,10 @@ def validate_binary_path():
+                               (utility + '.exe'))))
+ 
+             try:
++                # if path doesn't exist raise exception
++                if not os.path.exists(binary_path):
++                    current_app.logger.warning('Invalid binary path.')
++                    raise Exception()
+                 # Get the output of the '--version' command
+                 version_string = \
+                     subprocess.getoutput('"{0}" --version'.format(full_path))
+-- 
+2.38.1
+
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 46f212bee524..893a1e83d745 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -110,6 +110,7 @@ pythonPackages.buildPythonApplication rec {
   patches = [
     # Expose setup.py for later use
     ./expose-setup.py.patch
+    ./CVE-2022-4223.patch
   ];
 
   postPatch = ''