[rpms/perl-Catalyst-Plugin-Static-Simple] f45: Apply fix for CVE-2026-15743

[rpms/perl-Catalyst-Plugin-Static-Simple] f45: Apply fix for CVE-2026-15743

[Emmanuel Seyman]

A new commit has been pushed.

Repo   : rpms/perl-Catalyst-Plugin-Static-Simple
Branch : f45
Commit : 11cd816231f1312ed9efb28ffcfa1daebc70f72a
Author : Emmanuel Seyman <emmanuel@seyman.fr>
Date   : 2026-09-20T14:25:54+02:00
Stats  : +132/-5 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/perl-Catalyst-Plugin-Static-Simple/c/11cd816231f1312ed9efb28ffcfa1daebc70f72a?branch=f45

Log:
Apply fix for CVE-2026-15743

---
diff --git a/Catalyst-Plugin-Static-Simple-CVE-2026-15743.patch b/Catalyst-Plugin-Static-Simple-CVE-2026-15743.patch
new file mode 100644
index 0000000..138989d
--- /dev/null
+++ b/Catalyst-Plugin-Static-Simple-CVE-2026-15743.patch
@@ -0,0 +1,123 @@
+commit 17c031f7876a7d8b4ab156ac8be922004754efa5
+Author: Robert Rothenberg <perl@rhizomnic.com>
+Date:   Mon Aug 17 07:58:08 2026 +0100
+
+    Allow Cache-Control to be configured, and fix the Expires header
+    
+    The Cache-Control header was always set to public, with no means of
+    overriding it. (CVE-2026-15743)
+    
+    An expires header of 0 was ignored.
+    
+    This change allows the Cache-Control header to be overridden, and the
+    Expires header to be set to 0.
+    
+    Note: this patch was originally written by Claude Opus 5 but was
+    modified by RRWO to keep the default Cache-Control as "public", to
+    support configuring the default Cache-Control, and to simplify the logic
+    for handling the configured Expires header.  RRWO also added
+    documentation.
+    
+    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+    
+    Signed-off-by: Robert Rothenberg <perl@rhizomnic.com>
+
+diff --git a/lib/Catalyst/Plugin/Static/Simple.pm b/lib/Catalyst/Plugin/Static/Simple.pm
+index d8ee9c3..e657ca4 100755
+--- a/lib/Catalyst/Plugin/Static/Simple.pm
++++ b/lib/Catalyst/Plugin/Static/Simple.pm
+@@ -198,19 +198,32 @@ sub _serve_static {
+     my $config = $c->config->{'Plugin::Static::Simple'};
+ 
+     my $full_path = shift || $c->_static_file;
++    my $requested_cache_control = shift;
+     my $type      = $c->_ext_to_type( $full_path );
+     my $stat      = stat $full_path;
+ 
+     $c->res->headers->content_type( $type );
+     $c->res->headers->content_length( $stat->size );
+     $c->res->headers->last_modified( $stat->mtime );
+-    # Tell Firefox & friends its OK to cache, even over SSL:
+-    $c->res->headers->header('Cache-control' => 'public');
+-    # Optionally, set a fixed expiry time:
+-    if ($config->{expires}) {
+-        $c->res->headers->expires(time() + $config->{expires});
++
++    my $cache_control = $c->res->headers->header('Cache-Control')
++        || $requested_cache_control
++        || $config->{cache_control}
++        || 'public';
++
++    if ( defined $config->{expires} ) {
++
++        if ( $config->{expires} <= 0 ) {
++            $cache_control = 'no-store';
++            $c->res->headers->expires(0);
++        }
++        else {
++            $c->res->headers->expires(time() + $config->{expires});
++        }
+     }
+ 
++    $c->res->headers->header('Cache-Control' => $cache_control);
++
+     my $fh = IO::File->new( $full_path, 'r' );
+     if ( defined $fh ) {
+         binmode $fh;
+@@ -225,7 +238,7 @@ sub _serve_static {
+ }
+ 
+ sub serve_static_file {
+-    my ( $c, $full_path ) = @_;
++    my ( $c, $full_path, $cache_control ) = @_;
+ 
+     my $config = $c->config->{'Plugin::Static::Simple'};
+ 
+@@ -241,7 +254,7 @@ sub serve_static_file {
+         return;
+     }
+ 
+-    $c->_serve_static( $full_path );
++    $c->_serve_static( $full_path, $cache_control );
+ }
+ 
+ # looks up the correct MIME type for the current file extension
+@@ -480,6 +493,17 @@ module, you may enter your own extension to MIME type mapping.
+         },
+     );
+ 
++=head2 Controlling caching with the Cache-Control header
++
++By default, the Cache-Control header will be set to "public".
++That can be changed:
++
++    MyApp->config(
++        'Plugin::Static::Simple' => {
++            cache_control => 'private',
++        },
++    );
++
+ =head2 Controlling caching with Expires header
+ 
+ The files served by Static::Simple will have a Last-Modified header set,
+@@ -557,7 +581,7 @@ L<Catalyst::Engine::Apache2::MP20>.
+ 
+ =head1 PUBLIC METHODS
+ 
+-=head2 serve_static_file $file_path
++=head2 serve_static_file $file_path $cache_control
+ 
+ Will serve the file located in $file_path statically. This is useful when
+ you need to  autogenerate them if they don't exist, or they are stored in a model.
+@@ -570,6 +594,11 @@ you need to  autogenerate them if they don't exist, or they are stored in a mode
+         $c->serve_static_file($file_path);
+     }
+ 
++The $cache_control option will default to what is configured (or to
++"public" if not configured).  It can be overridden for specific files:
++
++    $c->serve_static_file( $file_path, "private" );
++
+ =head1 INTERNAL EXTENDED METHODS
+ 
+ Static::Simple extends the following steps in the Catalyst process.

diff --git a/perl-Catalyst-Plugin-Static-Simple.spec b/perl-Catalyst-Plugin-Static-Simple.spec
index 4068e0f..1da494a 100644
--- a/perl-Catalyst-Plugin-Static-Simple.spec
+++ b/perl-Catalyst-Plugin-Static-Simple.spec
@@ -1,12 +1,12 @@
 Name:           perl-Catalyst-Plugin-Static-Simple
 Version:        0.38
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Make serving static pages painless
-# Automatically converted from old format: GPL+ or Artistic - review is highly recommended.
 License:        GPL-1.0-or-later OR Artistic-1.0-Perl
 
-URL:            https://metacpan.org/release/Catalyst-Plugin-Static-Simple
+URL:            https://metacpan.org/dist/Catalyst-Plugin-Static-Simple
 Source0:        https://cpan.metacpan.org/authors/id/E/ET/ETHER/Catalyst-Plugin-Static-Simple-%{version}.tar.gz
+Patch0:         Catalyst-Plugin-Static-Simple-CVE-2026-15743.patch
 BuildArch:      noarch
 
 BuildRequires:  coreutils
@@ -55,6 +55,7 @@ single line of code from you.
 
 %prep
 %setup -q -n Catalyst-Plugin-Static-Simple-%{version}
+%patch -P 0 -p1
 
 for file in t/07mime_types.t t/lib/IncTestApp/Controller/Root.pm \
             t/lib/TestApp.pm t/lib/TestApp/Controller/Root.pm; do
@@ -75,10 +76,13 @@ TEST_POD=1 %{make_build} test
 
 %files
 %doc Changes t/
-%{perl_vendorlib}/*
-%{_mandir}/man3/*
+%{perl_vendorlib}/Catalyst*
+%{_mandir}/man3/Catalyst*
 
 %changelog
+* Sun Sep 20 2026 Emmanuel Seyman <emmanuel@seyman.fr> - 0.38-2
+- Apply fix for CVE-2026-15743
+
 * Sun Jul 19 2026 Emmanuel Seyman <emmanuel@seyman.fr> - 0.38-1
 - Update to 0.38