- diff -up pyxdg-0.25/xdg/BaseDirectory.py.CVE-2014-1624 pyxdg-0.25/xdg/BaseDirectory.py

- --- pyxdg-0.25/xdg/BaseDirectory.py.CVE-2014-1624	2014-12-04 11:49:53.681654931 -0500

- +++ pyxdg-0.25/xdg/BaseDirectory.py	2014-12-04 11:52:45.831522703 -0500

- @@ -25,7 +25,7 @@ Typical usage:

-  Note: see the rox.Options module for a higher-level API for managing options.

-  """

-  

- -import os

- +import os, stat

-  

-  _home = os.path.expanduser('~')

-  xdg_data_home = os.environ.get('XDG_DATA_HOME') or \

- @@ -131,15 +131,29 @@ def get_runtime_dir(strict=True):

-          

-          import getpass

-          fallback = '/tmp/pyxdg-runtime-dir-fallback-' + getpass.getuser()

- +        create = False

-          try:

- -            os.mkdir(fallback, 0o700)

- +            # This must be a real directory, not a symlink, so attackers can't

- +            # point it elsewhere. So we use lstat to check it.

- +            st = os.lstat(fallback)

-          except OSError as e:

-              import errno

- -            if e.errno == errno.EEXIST:

- -                # Already exists - set 700 permissions again.

- -                import stat

- -                os.chmod(fallback, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR)

- -            else: # pragma: no cover

- +            if e.errno == errno.ENOENT:

- +                create = True

- +            else:

-                  raise

- +        else:

- +            # The fallback must be a directory

- +            if not stat.S_ISDIR(st.st_mode):

- +                os.unlink(fallback)

- +                create = True

- +            # Must be owned by the user and not accessible by anyone else

- +            elif (st.st_uid != os.getuid()) \

- +              or (st.st_mode & (stat.S_IRWXG | stat.S_IRWXO)):

- +                os.rmdir(fallback)

- +                create = True

- +

- +        if create:

- +            os.mkdir(fallback, 0o700)

-          

-          return fallback

- diff -up pyxdg-0.25/xdg/Mime.py.BAD pyxdg-0.25/xdg/Mime.py

- --- pyxdg-0.25/xdg/Mime.py.BAD	2013-03-05 10:19:10.750845664 -0500

- +++ pyxdg-0.25/xdg/Mime.py	2013-03-05 10:19:14.771845520 -0500

- @@ -360,7 +360,8 @@ def _cache_database():

-              if pattern.startswith('*.'):

-                  rest = pattern[2:]

-                  if not ('*' in rest or '[' in rest or '?' in rest):

- -                    exts[rest] = mtype

- +                    if rest not in exts:

- +                        exts[rest] = mtype

-                      continue

-              if '*' in pattern or '[' in pattern or '?' in pattern:

-                  globs.append((pattern, mtype))

- diff -up pyxdg-0.26/xdg/Menu.py.fixOnlyShowIn pyxdg-0.26/xdg/Menu.py

- --- pyxdg-0.26/xdg/Menu.py.fixOnlyShowIn	2018-11-01 11:34:26.222123436 -0400

- +++ pyxdg-0.26/xdg/Menu.py	2018-11-01 11:36:39.459203908 -0400

- @@ -298,11 +298,11 @@ class Menu:

-                      entry.Show = NO_EXEC

-                      self.Visible -= 1

-                  elif xdg.Config.windowmanager:

- -                    if (entry.DesktopEntry.OnlyShowIn != [] and (

- -                            xdg.Config.windowmanager not in entry.DesktopEntry.OnlyShowIn

- +                    if (entry.DesktopEntry.getOnlyShowIn() != [] and (

- +                            xdg.Config.windowmanager not in entry.DesktopEntry.getOnlyShowIn()

-                          )

-                      ) or (

- -                        xdg.Config.windowmanager in entry.DesktopEntry.NotShowIn

- +                        xdg.Config.windowmanager in entry.DesktopEntry.getNotShowIn()

-                      ):

-                          entry.Show = NOT_SHOW_IN

-                          self.Visible -= 1

- diff -up pyxdg-0.26/xdg/Menu.py.getTypefix pyxdg-0.26/xdg/Menu.py

- --- pyxdg-0.26/xdg/Menu.py.getTypefix	2018-11-01 11:37:50.561645188 -0400

- +++ pyxdg-0.26/xdg/Menu.py	2018-11-30 11:33:10.728729275 -0500

- @@ -994,8 +994,8 @@ class XMLMenuBuilder(object):

-                      menuentry = MenuEntry(directory, dir)

-                      if not menu.Directory:

-                          menu.Directory = menuentry

- -                    elif menuentry.Type == MenuEntry.TYPE_SYSTEM:

- -                        if menu.Directory.Type == MenuEntry.TYPE_USER:

- +                    elif menuentry.getType() == MenuEntry.TYPE_SYSTEM:

- +                        if menu.Directory.getType() == MenuEntry.TYPE_USER:

-                              menu.Directory.Original = menuentry

-              if menu.Directory:

-                  break

- Version:        0.26

- Release:        12%{?dist}

- Source0:        https://pypi.python.org/packages/source/r/PyXDG/%{name}-%{version}.tar.gz

- # https://gitlab.freedesktop.org/xdg/pyxdg/merge_requests/2

- Patch0:         pyxdg-0.26-fix-OnlyShowIn.patch

- Patch1:         pyxdg-0.26-getType-fix.patch

- %patch0 -p1 -b .fixOnlyShowIn

- %patch1 -p1 -b .getType

- %{python3_sitelib}/xdg

- SHA512 (pyxdg-0.26.tar.gz) = f5306e6e15af07df2599017500fc8ad83e722e5d5c6e4fda014aab1d77df92a3c3199a5be7a889faaecab72861e9910be9d80142d29856eb7a11f6ab9a923bd2