[arch-commits] Commit in hplip/trunk (PKGBUILD hplip-CVE-2013-4325.patch)

[Andreas Radke]

    Date: Sunday, October 13, 2013 @ 22:05:28
  Author: andyrtr
Revision: 196443

upgpkg: hplip 3.13.9-3

add patch for CVE-2013-4325; FS#37168

Added:
  hplip/trunk/hplip-CVE-2013-4325.patch
Modified:
  hplip/trunk/PKGBUILD

---------------------------+
 PKGBUILD                  |   26 +++++++++++++++++++-------
 hplip-CVE-2013-4325.patch |   22 ++++++++++++++++++++++
 2 files changed, 41 insertions(+), 7 deletions(-)

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2013-10-13 19:45:46 UTC (rev 196442)
+++ PKGBUILD	2013-10-13 20:05:28 UTC (rev 196443)
@@ -5,7 +5,7 @@
 
 pkgname=hplip
 pkgver=3.13.9
-pkgrel=2
+pkgrel=3
 pkgdesc="Drivers for HP DeskJet, OfficeJet, Photosmart, Business Inkjet and some LaserJet"
 arch=('i686' 'x86_64')
 url="http://hplipopensource.com"
@@ -26,17 +26,22 @@
 options=('!libtool')
 install=hplip.install
 source=(http://downloads.sourceforge.net/${pkgname}/$pkgname-$pkgver.tar.gz{,.asc}
-        hp-mkuri.patch)
+        hp-mkuri.patch
+        hplip-CVE-2013-4325.patch)
 md5sums=('8fcbbd0d3a0b76550f325bd6cf46d9d9'
          'SKIP'
-         '0bd7779fdbc4d7a9386df04dce2cb8d4')
+         '0bd7779fdbc4d7a9386df04dce2cb8d4'
+         '947db41ee8556c78dd027a2f107957e6')
 
-build() {
- cd "$srcdir/$pkgname-$pkgver"
+prepare() {
+ cd $pkgname-$pkgver
 
  # fix linking libnotify, FS#34283
  patch -Np0 -i ${srcdir}/hp-mkuri.patch
  
+ # https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4325
+ patch -Np1 -i ${srcdir}/hplip-CVE-2013-4325.patch
+ 
  export PYTHON=python2
  
  find . -type f -exec sed -i 's~^#.*env python~#!/usr/bin/env python2~' {} +
@@ -61,7 +66,10 @@
    
  export AUTOMAKE='automake --foreign'
  autoreconf --force --install
+}
 
+build() {
+ cd $pkgname-$pkgver
  ./configure --prefix=/usr \
              --enable-qt4 \
              --disable-foomatic-rip-hplip-install \
@@ -79,15 +87,19 @@
 }
 
 package() {
- #cd "$srcdir/$pkgname-$pkgver"
- cd "$srcdir/$pkgname-${pkgver/.a/a}"
+ #cd $pkgname-$pkgver
+ cd $pkgname-${pkgver/.a/a}
  make rulesdir=/usr/lib/udev/rules.d DESTDIR="$pkgdir/" install
+ 
  # remove config provided by sane and autostart of hp-daemon
  rm -rf "$pkgdir"/etc/{sane.d,xdg}
+ 
  # remove HAL .fdi file because HAL is no longer used
  rm -rf "$pkgdir"/usr/share/hal
+ 
  # log dir should not be world writeable
  chmod 775 "$pkgdir"/var/log/hp{,/tmp}
+ 
  # remove rc script
  rm -rf "$pkgdir"/etc/init.d
 }

Added: hplip-CVE-2013-4325.patch
===================================================================
--- hplip-CVE-2013-4325.patch	                        (rev 0)
+++ hplip-CVE-2013-4325.patch	2013-10-13 20:05:28 UTC (rev 196443)
@@ -0,0 +1,22 @@
+diff -up hplip-3.13.7/base/pkit.py.CVE-2013-4325 hplip-3.13.7/base/pkit.py
+--- hplip-3.13.7/base/pkit.py.CVE-2013-4325	2013-07-23 06:18:29.000000000 +0100
++++ hplip-3.13.7/base/pkit.py	2013-09-11 10:54:13.252419283 +0100
+@@ -176,15 +176,10 @@ class PolicyKitService(dbus.service.Obje
+                                     "/org/freedesktop/PolicyKit1/Authority",
+                                     "org.freedesktop.PolicyKit1.Authority")
+         policy_kit = dbus.Interface(obj, "org.freedesktop.PolicyKit1.Authority")
+-        info = dbus.Interface(connection.get_object("org.freedesktop.DBus",
+-                                                    "/org/freedesktop/DBus/Bus",
+-                                                    False),
+-                              "org.freedesktop.DBus")
+-        pid = info.GetConnectionUnixProcessID(sender)
+         
+         subject = (
+-            'unix-process',
+-            { 'pid' : dbus.UInt32(pid, variant_level = 1) }
++            'system-bus-name',
++            { 'name' : dbus.String(sender, variant_level = 1) }
+         )
+         details = { '' : '' }
+         flags = dbus.UInt32(1)         # AllowUserInteraction = 0x00000001
+