aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
authorTobias Geerinckx-Rice <me@tobias.gr>2018-01-11 00:54:22 +0100
committerTobias Geerinckx-Rice <me@tobias.gr>2018-01-11 03:16:00 +0100
commitf26fa354f1d76ce9cbc43cc553637af3f0c34cc2 (patch)
tree93867d59576eaa63fa9ffa1eb71eb8d820a1487e /gnu/packages/patches
parente21888dd0d0abfb6fa89a2d5b4689e36db238391 (diff)
downloadguix-f26fa354f1d76ce9cbc43cc553637af3f0c34cc2.tar
guix-f26fa354f1d76ce9cbc43cc553637af3f0c34cc2.tar.gz
gnu: newsbeuter: Deprecate in favour of newsboat.
* gnu/packages/syndication.scm (newsbeuter): Redefine using ‘deprecated-package’. * gnu/packages/patches/newsbeuter-CVE-2017-12904.patch: Delete file. * gnu/packages/patches/newsbeuter-CVE-2017-14500.patch: Likewise. * gnu/local.mk (dist_patch_DATA): Remove both.
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/newsbeuter-CVE-2017-12904.patch34
-rw-r--r--gnu/packages/patches/newsbeuter-CVE-2017-14500.patch43
2 files changed, 0 insertions, 77 deletions
diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch b/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch
deleted file mode 100644
index 8e90502469..0000000000
--- a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-Fix CVE-2017-12904:
-
-https://github.com/akrennmair/newsbeuter/issues/591
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12904
-
-Patch copied from the Debian package of newsbeuter, version 2.9-5+deb9u1.
-
-Adapted from upstream source repository:
-
-https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
-
-Description: Fix a RCE vulnerability in the bookmark command
- Newsbeuter didn't properly escape the title and description fields before
- passing them to the bookmarking program which could lead to remote code
- execution using the shells command substitution functionality (e.g. "$()", ``,
- etc)
-
-Origin: upstream, https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
-Last-Update: 2017-08-18
-
---- newsbeuter-2.9.orig/src/controller.cpp
-+++ newsbeuter-2.9/src/controller.cpp
-@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s
- std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
- bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive");
- if (bookmark_cmd.length() > 0) {
-- std::string cmdline = utils::strprintf("%s '%s' %s %s",
-+ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
- bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(),
-- stfl::quote(title).c_str(), stfl::quote(description).c_str());
-+ utils::replace_all(title,"'", "%27").c_str(),
-+ utils::replace_all(description,"'", "%27").c_str());
-
- LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str());
diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch b/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch
deleted file mode 100644
index 449105e42a..0000000000
--- a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333.patch
-http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14500
-
-From 26f5a4350f3ab5507bb8727051c87bb04660f333 Mon Sep 17 00:00:00 2001
-From: Alexander Batischev <eual.jp@gmail.com>
-Date: Sat, 16 Sep 2017 19:31:43 +0300
-Subject: [PATCH] Work around shell code in podcast names (#598)
-
----
- src/pb_controller.cpp | 6 +++---
- src/queueloader.cpp | 2 +-
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
-index 09b5e897..213216cd 100644
---- a/src/pb_controller.cpp
-+++ b/src/pb_controller.cpp
-@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) {
- if (player == "")
- return;
- cmdline.append(player);
-- cmdline.append(" \"");
-- cmdline.append(utils::replace_all(file,"\"", "\\\""));
-- cmdline.append("\"");
-+ cmdline.append(" \'");
-+ cmdline.append(utils::replace_all(file,"'", "%27"));
-+ cmdline.append("\'");
- stfl::reset();
- LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str());
- ::system(cmdline.c_str());
-diff --git a/src/queueloader.cpp b/src/queueloader.cpp
-index c1dabdd8..ae725e04 100644
---- a/src/queueloader.cpp
-+++ b/src/queueloader.cpp
-@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) {
- strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
- fn.append(lbuf);
- } else {
-- fn.append(base);
-+ fn.append(utils::replace_all(base, "'", "%27"));
- }
- return fn;
- }