--- uzbl-0.0.0~git.20111128.orig/debian/postinst +++ uzbl-0.0.0~git.20111128/debian/postinst @@ -0,0 +1,13 @@ +#!/bin/sh +set -e + +if [ "$1" = configure ]; then + update-alternatives --install /usr/bin/x-www-browser x-www-browser /usr/bin/uzbl-browser 10 +fi + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 --- uzbl-0.0.0~git.20111128.orig/debian/changelog +++ uzbl-0.0.0~git.20111128/debian/changelog @@ -0,0 +1,181 @@ +uzbl (0.0.0~git.20111128-2) unstable; urgency=high + + * Security fix for CVE-2012-0843 + + Restrict third-party access to cookie jar (Closes: #659379) + + -- Luca Bruno Tue, 14 Feb 2012 18:14:55 +0100 + +uzbl (0.0.0~git.20111128-1) unstable; urgency=low + + * New upstream version + + -- Luca Bruno Thu, 08 Dec 2011 18:46:55 +0100 + +uzbl (0.0.0~git.20111001-1) unstable; urgency=low + + * New upstream version + + -- Luca Bruno Sat, 26 Nov 2011 11:28:14 +0100 + +uzbl (0.0.0~git.20110412-2) unstable; urgency=low + + * Moving suggested packages to Recommends (Closes: #626815, #626818) + * Increase required python version to 2.6, for plugins (Closes: #642491) + * Update build-dep for libwebkitgtk renaming (Closes: #635429, #646475) + + -- Luca Bruno Mon, 07 Nov 2011 13:42:21 +0100 + +uzbl (0.0.0~git.20110412-1) unstable; urgency=low + + [ Francesca Ciceri ] + * Added suckless-tools as alternative to dwm-tools on Suggests field + + [ Luca Bruno ] + * New Upstream version + * Removed Stefan from maintainers list (Closes: #607325) + + -- Luca Bruno Wed, 13 Apr 2011 11:58:50 +0200 + +uzbl (0.0.0~git.20110317-1) unstable; urgency=low + + * New upstream relese + + Fixed broken uzbl-tabbed (Closes: #618919, #618626) + + -- Luca Bruno Mon, 21 Mar 2011 11:56:56 +0100 + +uzbl (0.0.0~git.20110314-1) unstable; urgency=low + + * Bumped libwebkit-dev dependency to avoid segfault on kfreebsd-i386 + (Closes: #559489) + * Fix FTBFS with gold or ld --no-add-needed (Closes: #615790) + * New upstream release + + Fixed "Open in new window" context menu (Closes: #606669) + + Breaks backward compatibility, please read NEWS.Debian + + -- Luca Bruno Wed, 16 Mar 2011 16:48:25 +0100 + +uzbl (0.0.0~git.20100403-3) unstable; urgency=high + + * Fix unsafe URI handling in default config, which may lead to arbitrary + command execution, CVE-2010-2809 (Closes: #594301) + * Added NEWS.Debian suggesting how to fix user customized config in home + directory + + -- Luca Bruno Fri, 27 Aug 2010 16:26:30 +0200 + +uzbl (0.0.0~git.20100403-2) unstable; urgency=low + + [ Stefan Ritter ] + * Fix lintian warning (executable-not-elf-or-script) + * Add source format (1.0) + + [ Luca Bruno ] + * Add patch to fix bashisms (Closes: #581145, #577716, #579115) + + -- Luca Bruno Sat, 15 May 2010 22:00:14 +0200 + +uzbl (0.0.0~git.20100403-1) unstable; urgency=low + + [ Luca Bruno ] + * Fix wrong statement in uzbl manpage regarding config from stdin + + [ Clint Adams ] + * New upstream version. closes: #576897. + - Drop fix-install patch and set DOCDIR instead. + + -- Clint Adams Thu, 08 Apr 2010 10:26:02 -0400 + +uzbl (0.0.0~git.20100314-1) unstable; urgency=low + + * New upstream version + + -- Luca Bruno Sat, 20 Mar 2010 20:34:09 +0100 + +uzbl (0.0.0~git.20100202-1) unstable; urgency=low + + [ Luca Bruno ] + * New upstream version, git-tag 2010.02.02 (Closes: #572159) + + uzbl-tabbed and linkfollowing should be working again, with newer + default config + * Refreshed patches, dropping those already fixed upstream + * Updated Standards-Version to 3.8.4 + + [ Stefan Ritter ] + * Added manpages for uzbl-cookie-daemon and uzbl-event-manager + * Added alternative for x-www-browser, now providing www-browser too + (Closes: #564067) + + -- Luca Bruno Sat, 06 Mar 2010 15:07:00 +0100 + +uzbl (0.0.0~git.20100105-1) unstable; urgency=high + + * New upstream version, git-tag 2010.01.05 + + security release, disable global Uzbl JS object; this may break + external scripts depending on it (CVE-2010-0011) + + -- Luca Bruno Wed, 06 Jan 2010 22:42:34 +0100 + +uzbl (0.0.0~git.20091222-1) unstable; urgency=low + + * New upstream version, git-tag 2009.12.22 + + -- Luca Bruno Thu, 24 Dec 2009 17:41:34 +0100 + +uzbl (0.0.0~git.20091130-2) unstable; urgency=low + + * Added python-gtk2 and python-gobject as dependencies since uzbl-tabbed + needs them (Closes: #559336) + * Added xclip and python-simplejson to suggests (Closes: #559337) + + -- Stefan Ritter Fri, 18 Dec 2009 10:20:00 +0200 + +uzbl (0.0.0~git.20091130-1) unstable; urgency=low + + [ Stefan Ritter ] + * Added symlinks for missing manpages + * Do not ship INSTALL file in binary package + + [ Luca Bruno ] + * New upstream version, git-tag 20091130 + * Added python-support helper for python dependencies + * Various original helper scripts were dropped upstream + * The 'Ran out of links' warnings are caused by a regression in GTK. + This is now fixed in gtk upstream. + * Installing scripts to /usr/share and symlinking to doc/; dropping all + our previous patches regarding scripts location (Closes: #558384) + + -- Luca Bruno Thu, 03 Dec 2009 11:25:33 +0100 + +uzbl (0.0.0~git.20091107-1) unstable; urgency=low + + * New upstream version, git-tag 20091107 (Closes: #555132) + + Build without G_ERRORCHECK_MUTEXES flag (Closes: #554154) + * Documentation path patch no more needed, dropped + * Now symlinking main uzbl binary to uzbl-browser, it will take + care of setting proper config and path + * Some tweaks to Makefile to ease packaging + * Make statusbar label not selectable, temporary fix for + gtk-warning ("Ran out of links") + + -- Luca Bruno Sun, 15 Nov 2009 20:12:32 +0100 + +uzbl (0.0.0~git.20090912-1) unstable; urgency=low + + [ Stefan Ritter ] + * New upstream release + * Added 'socat' to Suggests + * Switched to quilt + * Removed debian/uzblctrl.1 + + [ Luca Bruno ] + * Fixed config and docs to match and use a saner path. + You can now directly follow README suggestions, or straightly copy + data and config dirs to your xdg path. + + -- Luca Bruno Sat, 31 Oct 2009 09:00:11 +0100 + +uzbl (0.0.0~git.20090826-1) unstable; urgency=low + + * Initial Release (Closes: #530748) + + -- Stefan Ritter Wed, 26 Aug 2009 14:56:17 +0200 --- uzbl-0.0.0~git.20111128.orig/debian/menu +++ uzbl-0.0.0~git.20111128/debian/menu @@ -0,0 +1,2 @@ +?package(uzbl):needs="x11" section="Applications/Network/Web Browsing"\ + title="uzbl" command="/usr/bin/uzbl" --- uzbl-0.0.0~git.20111128.orig/debian/README.source +++ uzbl-0.0.0~git.20111128/debian/README.source @@ -0,0 +1,58 @@ +This package uses quilt to manage all modifications to the upstream +source. Changes are stored in the source package as diffs in +debian/patches and applied during the build. + +To configure quilt to use debian/patches instead of patches, you want +either to export QUILT_PATCHES=debian/patches in your environment +or use this snippet in your ~/.quiltrc: + + for where in ./ ../ ../../ ../../../ ../../../../ ../../../../../; do + if [ -e ${where}debian/rules -a -d ${where}debian/patches ]; then + export QUILT_PATCHES=debian/patches + break + fi + done + +To get the fully patched source after unpacking the source package, cd to +the root level of the source package and run: + + quilt push -a + +The last patch listed in debian/patches/series will become the current +patch. + +To add a new set of changes, first run quilt push -a, and then run: + + quilt new + +where is a descriptive name for the patch, used as the filename in +debian/patches. Then, for every file that will be modified by this patch, +run: + + quilt add + +before editing those files. You must tell quilt with quilt add what files +will be part of the patch before making changes or quilt will not work +properly. After editing the files, run: + + quilt refresh + +to save the results as a patch. + +Alternately, if you already have an external patch and you just want to +add it to the build system, run quilt push -a and then: + + quilt import -P /path/to/patch + quilt push -a + +(add -p 0 to quilt import if needed). as above is the filename to +use in debian/patches. The last quilt push -a will apply the patch to +make sure it works properly. + +To remove an existing patch from the list of patches that will be applied, +run: + + quilt delete + +You may need to run quilt pop -a to unapply patches first before running +this command. --- uzbl-0.0.0~git.20111128.orig/debian/compat +++ uzbl-0.0.0~git.20111128/debian/compat @@ -0,0 +1 @@ +7 --- uzbl-0.0.0~git.20111128.orig/debian/control +++ uzbl-0.0.0~git.20111128/debian/control @@ -0,0 +1,40 @@ +Source: uzbl +Section: web +Priority: extra +Maintainer: Luca Bruno +Homepage: http://www.uzbl.org/ +Build-Depends: debhelper (>= 7.0.50), + quilt, + libgtk2.0-dev (>= 2.14), + libwebkitgtk-dev (>= 1.2.5-2.1), + libsoup2.4-dev (>= 2.24), + pkg-config, + python-support (>= 0.5.3) +Vcs-Git: git://git.debian.org/git/collab-maint/uzbl.git +Vcs-Browser: http://git.debian.org/?p=collab-maint/uzbl.git +Standards-Version: 3.9.1 +XS-Python-Version: >= 2.6 + + +Package: uzbl +Architecture: any +Depends: ${shlibs:Depends}, ${misc:Depends}, ${python:Depends}, python-gtk2, python-gobject +Provides: www-browser +Recommends: dwm-tools | suckless-tools, zenity, socat, xclip, python-simplejson +Description: Lightweight Webkit browser following the UNIX philosophy + Uzbl follows the UNIX philosophy - "Write programs that do one thing and do it + well. Write programs to work together. Write programs to handle text streams, + because that is a universal interface." + . + * very minimal graphical interface. You only see what you need + * what is not browsing, is not in uzbl. Things like url changing, + loading/saving of bookmarks, saving history, downloads, ... are handled + through external scripts that you write + * controllable through various means such as fifo and socket files, stdin, + keyboard and more + * advanced, customizable keyboard interface with support for modes, modkeys, + multichars, variables (keywords) etc. (eg you can tweak the interface to be + vim-like, emacs-like or any-other-program-like) + * focus on plaintext storage for your data and configs in simple, parseable + formats + * Uzbl keeps it simple, and puts _you_ in charge. --- uzbl-0.0.0~git.20111128.orig/debian/manpages +++ uzbl-0.0.0~git.20111128/debian/manpages @@ -0,0 +1,3 @@ +debian/uzbl.1 +debian/uzbl-cookie-daemon.1 +debian/uzbl-event-manager.1 --- uzbl-0.0.0~git.20111128.orig/debian/links +++ uzbl-0.0.0~git.20111128/debian/links @@ -0,0 +1,5 @@ +usr/bin/uzbl-browser usr/bin/uzbl +usr/share/man/man1/uzbl.1.gz usr/share/man/man1/uzbl-core.1.gz +usr/share/man/man1/uzbl.1.gz usr/share/man/man1/uzbl-browser.1.gz +usr/share/man/man1/uzbl.1.gz usr/share/man/man1/uzbl-tabbed.1.gz +usr/share/uzbl/examples usr/share/doc/uzbl/examples --- uzbl-0.0.0~git.20111128.orig/debian/uzbl-event-manager.1 +++ uzbl-0.0.0~git.20111128/debian/uzbl-event-manager.1 @@ -0,0 +1,36 @@ +.Dd Januar 04, 2010 +.Dt uzbl-event-manager 1 +.Os +.Sh NAME +.Nm uzbl-event-manager +.Nd Event manager for uzbl written in python +.Sh SYNOPSIS +.Nm +.Op options +.Op {start|stop|restart|list} +.Sh DESCRIPTION +Event manager for uzbl written in python +.Sh OPTIONS +.Bl -tag -width "v" +.It Fl h, Fl Fl help +show help message and exit +.It Fl v, Fl Fl verbose +print verbose output. +.It Fl d Ar DIRS , Fl Fl plugin\-dirs= Ar DIRS +Specify plugin directories in the form of 'dir1:dir2:dir3' +.It Fl l Ar PLUGINS , Fl Fl load\-plugins= Ar PLUGINS +comma separated list of plugins to load +.It Fl i Ar PLUGINS , Fl Fl ignore\-plugins= Ar PLUGINS +comma separated list of plugins to ignore +.It Fl p Ar FILE , Fl Fl pid\-file= Ar FILE +specify pid file location +.It Fl s Ar SOCKET , Fl Fl server\-socket= Ar SOCKET +specify the daemon socket location +.It Fl n , Fl Fl no\-daemon +don't enter daemon mode. +.It Fl a , Fl Fl auto\-close +auto close after all instances disconnect. +.El +.Sh AUTHORS +.Pp +This manual page was originally written by Stefan Ritter for the Debian project (but may be used by others). --- uzbl-0.0.0~git.20111128.orig/debian/preinst +++ uzbl-0.0.0~git.20111128/debian/preinst @@ -0,0 +1,17 @@ +#!/bin/sh +set -e + +if [ "$1" = upgrade -a -d /usr/share/doc/uzbl/examples -a ! -L /usr/share/doc/uzbl/examples ]; then + rm -rf /usr/share/doc/uzbl/examples +fi + +if [ "$1" = upgrade ]; then + update-alternatives --remove x-www-browser /usr/bin/uzbl-browser +fi + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 --- uzbl-0.0.0~git.20111128.orig/debian/docs +++ uzbl-0.0.0~git.20111128/debian/docs @@ -0,0 +1,10 @@ +AUTHORS +README +docs/COMMUNITY +docs/config-syntax +docs/CONTRIBUTING +docs/FAQ +docs/multiple-instances-management +docs/performance +docs/TODO +docs/url-editing --- uzbl-0.0.0~git.20111128.orig/debian/uzbl.1 +++ uzbl-0.0.0~git.20111128/debian/uzbl.1 @@ -0,0 +1,40 @@ +.TH "uzbl" "1" "Wed May 27 2009" "" "" +.SH "NAME" +uzbl \- A keyboard controlled browser based on Webkit +.SH "SYNOPSIS" +.B uzbl +[\-u URI] [\-v] [\-n NAME] [\-c CONFIG] +.SH "DESCRIPTION" +.TP +Very minimal interface. No unnecessary interface elements. +.PP +Controllable through a FIFO and with external scripts. +.PP +What is not browsing, is not in uzbl. Things like url changing, +loading/saving of bookmarks, saving history,.. are handled through external +scripts that you write. +.SH "OPTIONS" +.TP +.I "\-u, \-\-uri=URI" +Uri to load (equivalent to 'set uri = URI') +.TP +.I "\-v, \-\-verbose" +Whether to print all messages or just errors. +.TP +.I "\-n, \-\-name=NAME" +Name of the current instance (defaults to Xorg window id) +.TP +.I "\-c, \-\-config=FILE" +Config file (this is pretty much equivalent to uzbl \-c \- < FILE ) +.TP +.I "\-\-display=DISPLAY" +X display to use +.TP +.I "\-\-help" +Help +.SH "HOMEPAGE" +The uzbl homepage is http://www.uzbl.org. +.SH "AUTHORS" +Dieter Plaetinck (Dieter@be) . +.TP +See /usr/share/doc/uzbl/AUTHORS for all contributers. --- uzbl-0.0.0~git.20111128.orig/debian/gbp.conf +++ uzbl-0.0.0~git.20111128/debian/gbp.conf @@ -0,0 +1,9 @@ +[DEFAULT] +upstream-tag = upstream/%(version)s +debian-tag = debian/%(version)s +pristine-tar = True + +[git-import-orig] +upstream-branch = upstream +debian-branch = master + --- uzbl-0.0.0~git.20111128.orig/debian/uzbl.lintian-overrides +++ uzbl-0.0.0~git.20111128/debian/uzbl.lintian-overrides @@ -0,0 +1 @@ +uzbl binary: no-upstream-changelog --- uzbl-0.0.0~git.20111128.orig/debian/desktop +++ uzbl-0.0.0~git.20111128/debian/desktop @@ -0,0 +1,8 @@ +[Desktop Entry] +Encoding=UTF-8 +Name=uzbl +Comment=A browser that adheres to the unix philosophy +Exec=uzbl +Type=Application +Terminal=false +Categories=Network;WebBrowser; --- uzbl-0.0.0~git.20111128.orig/debian/copyright +++ uzbl-0.0.0~git.20111128/debian/copyright @@ -0,0 +1,82 @@ +This package was debianized by Stefan Ritter on Tue, 04 Aug +2009 13:52:48 +0200. + +The source can be downloaded from http://www.uzbl.org/. + +Author: Dieter Plaetinck + +Files: * +Copyright: © 2009 Dieter Plaetinck + © 2009 Robert Manea +License: GPL-3 + uzbl is published under the GNU Public License v3 without any + warranty implied or otherwise, with no suitability for any purpose. + Use this software at your own risk. + . + On Debian systems, the complete text of the GNU General Public + License, version 3, can be found in + /usr/share/common-licenses/GPL-3. + +Files: uzbl.c +Copyright: © 2006, 2007 Apple Inc. + © 2007 Alp Toker + © 2009 Dieter Plaetinck +License: GPL-3 and BSD-C2 + Original code taken from the example webkit-gtk+ application. see notice below. Modified code is licensed under the GPL 3. See LICENSE file. + . + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + . + THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY + EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE COMPUTER, INC. OR + CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY + OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Files: examples/data/uzbl/scripts/*.py +Copyright: © 2009 Tom Adams + © 2009 Dieter Plaetinck + © 2009 Mason Larobina +License: GPL-3+ + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + . + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + +Files: debian/* +Copyright: © 2009 Stefan Ritter + © 2009 Luca Bruno +License: GPL-2+ + This program is free software; you can redistribute it and/or + modify it under the terms of the GNU General Public License + as published by the Free Software Foundation; either version 2 + of the License, or (at your option) any later version. + . + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + . + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + . + On Debian systems, the complete text of the GNU General Public License + can be found in /usr/share/common-licenses/GPL-2 file. --- uzbl-0.0.0~git.20111128.orig/debian/uzbl-cookie-daemon.1 +++ uzbl-0.0.0~git.20111128/debian/uzbl-cookie-daemon.1 @@ -0,0 +1,38 @@ +.Dd Januar 04, 2010 +.Dt uzbl-cookie-daemon 1 +.Os +.Sh NAME +.Nm uzbl-cookie-daemon +.Nd Serving cookies to different groups of uzbl instances +.Sh SYNOPSIS +.Nm +.Op options +.Op {start|stop|restart|reload} +.Sh DESCRIPTION +Serving cookies to different groups of uzbl instances +.Sh OPTIONS +.Bl -tag -width "v" +.It Fl h, Fl Fl help +show help message and exit +.It Fl n, Fl Fl no\-daemon +don't daemonise the process. +.It Fl v, Fl Fl verbose +print verbose output. +.It Fl t Ar SECONDS , Fl Fl daemon\-timeout= Ar SECONDS +shutdown the daemon after x seconds inactivity. +WARNING: Do not use this when launching the cookie +daemon manually. +.It Fl s Ar SOCKET , Fl Fl cookie\-socket= Ar SOCKET +manually specify the socket location. +.It Fl j Ar FILE , Fl Fl cookie\-jar= Ar FILE +manually specify the cookie jar location. +.It Fl m, Fl Fl memory +store cookies in memory only - do not write to disk +.It Fl u, Fl Fl use\-whitelist +use cookie whitelist policy +.It Fl w Ar FILE , Fl Fl cookie\-whitelist= Ar FILE +manually specify whitelist location +.El +.Sh AUTHORS +.Pp +This manual page was originally written by Stefan Ritter for the Debian project (but may be used by others). --- uzbl-0.0.0~git.20111128.orig/debian/NEWS +++ uzbl-0.0.0~git.20111128/debian/NEWS @@ -0,0 +1,29 @@ +uzbl (0.0.0~git.20110314-1) unstable; urgency=low + + This release introduces lots of changes with regard to default configuration + and external handlers, which break backward compatibility. + + Major changes include: + * parseenv() removed + * download handler rework + * renamed positional arguments + * cookie daemon support removed + + Please read http://www.uzbl.org/wiki/experimental-branch and update your + ~/.config/uzbl/config accordingly. + + -- Luca Bruno Wed, 16 Mar 2011 16:22:17 +0100 + +uzbl (0.0.0~git.20100403-3) unstable; urgency=high + + Example config file shipped in uzbl prior to this version contains an unsafe + keybinding for which may lead to remote command execution. + If you are using and old default config file, you're advised to use a newer + one (available at /usr/share/doc/uzbl/examples/config/config) as your + ~/.config/uzbl/config file. + If you are using a customized config based on an old default file, + you may want to amend keybinding in your ~/.config/uzbl/config as follow: + + bind = sh 'if [ "$8" ]; then uzbl-browser -u "$8"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi' \@SELECTED_URI + + -- Luca Bruno Fri, 27 Aug 2010 17:05:28 +0200 --- uzbl-0.0.0~git.20111128.orig/debian/watch +++ uzbl-0.0.0~git.20111128/debian/watch @@ -0,0 +1,4 @@ +version=3 + +opts=dversionmangle=s/(\d+\.*){3}~git\.//,uversionmangle=s/\.//g \ + http://githubredir.debian.net/github/Dieterbe/uzbl/(\d.*)\.tar\.gz --- uzbl-0.0.0~git.20111128.orig/debian/rules +++ uzbl-0.0.0~git.20111128/debian/rules @@ -0,0 +1,38 @@ +#!/usr/bin/make -f + +include /usr/share/quilt/quilt.make +export LIBS+='-lX11' + +override_dh_auto_test: + echo "Skipping tests..." + +override_dh_compress: + dh_compress -XCONTRIBUTING -XFAQ -XREADME -XTODO -Xconfig \ + -Xcookies.sh -X.js -X.py + +override_dh_auto_install: + DESTDIR="$(CURDIR)/debian/uzbl" PREFIX="/usr" make install DOCDIR='$${DESTDIR}/usr/share/doc/uzbl' + rm -f $(CURDIR)/debian/uzbl/usr/share/doc/uzbl/INSTALL + # fix lintian warning + chmod 0644 $(CURDIR)/debian/uzbl/usr/share/uzbl/examples/data/scripts/*.js + chmod 0755 $(CURDIR)/debian/uzbl/usr/share/uzbl/examples/data/scripts/util/*.sh + +build: build-stamp +build-stamp: $(QUILT_STAMPFN) + dh build + touch build-stamp + +clean: unpatch + dh clean + +install: build +install-stamp: patch-stamp + dh install + +binary-arch: install + dh binary-arch + +binary-indep: install + dh binary-indep + +binary: binary-arch binary-indep --- uzbl-0.0.0~git.20111128.orig/debian/patches/series +++ uzbl-0.0.0~git.20111128/debian/patches/series @@ -0,0 +1 @@ +CVE-2012-0843.patch --- uzbl-0.0.0~git.20111128.orig/debian/patches/CVE-2012-0843.patch +++ uzbl-0.0.0~git.20111128/debian/patches/CVE-2012-0843.patch @@ -0,0 +1,74 @@ +commit 0d747f8715f2b9d2acddda8748e0c3f838f197de +Author: Luca Bruno +Date: Sat Feb 11 15:23:14 2012 +0100 + + Restrict third-party access to cookie jar (CVE-2012-0843) + + Make sure new cookie jar is created with no permission for "others", + and remove excessive rights on existing jar if any. + This fixes CVE-2012-0843 and uzbl bug #291. + + Signed-off-by: Luca Bruno + +diff --git a/examples/data/plugins/cookies.py b/examples/data/plugins/cookies.py +index e29ee36..721feef 100644 +--- a/examples/data/plugins/cookies.py ++++ b/examples/data/plugins/cookies.py +@@ -2,7 +2,7 @@ + forwards cookies to all other instances connected to the event manager""" + + from collections import defaultdict +-import os, re ++import os, re, stat + + # these are symbolic names for the components of the cookie tuple + symbolic = {'domain': 0, 'path':1, 'name':2, 'value':3, 'scheme':4, 'expires':5} +@@ -32,6 +32,14 @@ class ListStore(list): + class TextStore(object): + def __init__(self, filename): + self.filename = filename ++ try: ++ # make sure existing cookie jar is not world-open ++ perm_mode = os.stat(self.filename).st_mode ++ if (perm_mode & (stat.S_IRWXO | stat.S_IRWXG)) > 0: ++ safe_perm = stat.S_IMODE(perm_mode) & ~(stat.S_IRWXO | stat.S_IRWXG) ++ os.chmod(self.filename, safe_perm) ++ except OSError: ++ pass + + def as_event(self, cookie): + """Convert cookie.txt row to uzbls cookie event format""" +@@ -76,16 +84,25 @@ class TextStore(object): + # delete equal cookies (ignoring expire time, value and secure flag) + self.delete_cookie(None, cookie[:-3]) + ++ # restrict umask before creating the cookie jar ++ curmask=os.umask(0) ++ os.umask(curmask| stat.S_IRWXO | stat.S_IRWXG) ++ + first = not os.path.exists(self.filename) + with open(self.filename, 'a') as f: + if first: + print >> f, "# HTTP Cookie File" + print >> f, '\t'.join(self.as_file(cookie)) ++ os.umask(curmask) + + def delete_cookie(self, rkey, key): + if not os.path.exists(self.filename): + return + ++ # restrict umask before creating the cookie jar ++ curmask=os.umask(0) ++ os.umask(curmask | stat.S_IRWXO | stat.S_IRWXG) ++ + # read all cookies + with open(self.filename, 'r') as f: + cookies = f.readlines() +@@ -96,6 +113,7 @@ class TextStore(object): + c = self.as_event(l.split('\t')) + if c is None or not match(key, c): + print >> f, l, ++ os.umask(curmask) + + xdg_data_home = os.environ.get('XDG_DATA_HOME', os.path.join(os.environ['HOME'], '.local/share')) + DefaultStore = TextStore(os.path.join(xdg_data_home, 'uzbl/cookies.txt')) --- uzbl-0.0.0~git.20111128.orig/debian/patches/fix-bashisms +++ uzbl-0.0.0~git.20111128/debian/patches/fix-bashisms @@ -0,0 +1,17 @@ +Index: uzbl/examples/config/config +=================================================================== +--- uzbl.orig/examples/config/config 2011-11-26 11:26:16.000000000 +0100 ++++ uzbl/examples/config/config 2011-11-26 11:35:14.137467555 +0100 +@@ -307,9 +307,9 @@ + @cbind zS = event REQ_NEW_WINDOW \@(echo "$UZBL_URI" | sed -e 's/^http:/https:/')\@ + + # Yanking & pasting binds +-@cbind yu = sh 'echo -n "$UZBL_URI" | xclip' +-@cbind yU = sh 'echo -n "$1" | xclip' '\@SELECTED_URI' +-@cbind yy = sh 'echo -n "$UZBL_TITLE" | xclip' ++@cbind yu = sh 'printf "$UZBL_URI" | xclip' ++@cbind yU = sh 'printf "$1" | xclip' '\@SELECTED_URI' ++@cbind yy = sh 'printf "$UZBL_TITLE" | xclip' + + # Clone current window + @cbind c = event REQ_NEW_WINDOW \@uri --- uzbl-0.0.0~git.20111128.orig/debian/source/format +++ uzbl-0.0.0~git.20111128/debian/source/format @@ -0,0 +1 @@ +1.0