[gentoo-commits] gentoo-x86 commit in dev-python/cherrypy/files: cherrypy-2.2.1-invalidsession.patch cherrypy-2.2.1-py2.5.patch digest-cherrypy-2.2.1-r2 digest-cherrypy-3.0.2 cherrypy-2.1.1-test-gentoo.patch digest-cherrypy-2.2.1-r1 digest-cherrypy-2.1.1

[Ali Polatel (hawking)]

hawking     08/01/08 22:18:12

  Added:                cherrypy-2.2.1-invalidsession.patch
                        cherrypy-2.2.1-py2.5.patch digest-cherrypy-2.2.1-r2
  Removed:              digest-cherrypy-3.0.2
                        cherrypy-2.1.1-test-gentoo.patch
                        digest-cherrypy-2.2.1-r1 digest-cherrypy-2.1.1
  Log:
  Revision bump. Backported security patch for 2.2.1, bug 204829. Added patch to fix tests for python-2.5. Drop old.
  (Portage version: 2.1.4_rc14)

Revision  Changes    Path
1.1                  dev-python/cherrypy/files/cherrypy-2.2.1-invalidsession.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-python/cherrypy/files/cherrypy-2.2.1-invalidsession.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-python/cherrypy/files/cherrypy-2.2.1-invalidsession.patch?rev=1.1&content-type=text/plain

Index: cherrypy-2.2.1-invalidsession.patch
===================================================================
--- cherrypy/filters/sessionfilter.py	2006-04-25 04:37:45.000000000 +0300
+++ cherrypy/filters/sessionfilter.py	2008-01-08 23:01:09.000000000 +0200
@@ -326,6 +326,8 @@
             raise SessionStoragePathNotConfiguredError()
         fileName = self.SESSION_PREFIX + id
         file_path = os.path.join(storage_path, fileName)
+        if not os.path.normpath(file_path).startswith(storage_path):
+            raise cherrypy.HTTPError(400, "Invalid session id in cookie.")
         return file_path
     
     def _lock_file(self, path):
--- cherrypy/test/test_session_filter.py	2006-04-25 04:37:40.000000000 +0300
+++ cherrypy/test/test_session_filter.py	2008-01-08 23:00:39.000000000 +0200
@@ -28,7 +28,7 @@
             'server.environment': 'production',
             'session_filter.on': True,
             'session_filter.storage_type' : 'file',
-            'session_filter.storage_path' : '.',
+            'session_filter.storage_path' : os.path.abspath('.'),
     })
 
 import helper



1.1                  dev-python/cherrypy/files/cherrypy-2.2.1-py2.5.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-python/cherrypy/files/cherrypy-2.2.1-py2.5.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-python/cherrypy/files/cherrypy-2.2.1-py2.5.patch?rev=1.1&content-type=text/plain

Index: cherrypy-2.2.1-py2.5.patch
===================================================================
diff -ur CherryPy-2.2.1/cherrypy/test/test_core.py CherryPy-2.2.1-py2.5/cherrypy/test/test_core.py
--- CherryPy-2.2.1/cherrypy/test/test_core.py	2006-04-25 04:37:40.000000000 +0300
+++ CherryPy-2.2.1-py2.5/cherrypy/test/test_core.py	2008-01-08 23:37:55.000000000 +0200
@@ -824,15 +824,27 @@
         self.assertBody(data)
     
     def testCookies(self):
-        self.getPage("/cookies/single?name=First",
+        import sys
+        if sys.version_info >= (2, 5):
+            self.getPage("/cookies/single?name=First",
+                    [('Cookie', 'First=Dinsdale;')])
+            self.assertHeader('Set-Cookie', 'First=Dinsdale')
+
+            self.getPage("/cookies/multiple?names=First&names=Last",
+                    [('Cookie', 'First=Dinsdale; Last=Piranha;'),
+                        ])
+            self.assertHeader('Set-Cookie', 'First=Dinsdale')
+            self.assertHeader('Set-Cookie', 'Last=Piranha')
+        else:
+            self.getPage("/cookies/single?name=First",
                      [('Cookie', 'First=Dinsdale;')])
-        self.assertHeader('Set-Cookie', 'First=Dinsdale;')
+            self.assertHeader('Set-Cookie', 'First=Dinsdale;')
         
-        self.getPage("/cookies/multiple?names=First&names=Last",
+            self.getPage("/cookies/multiple?names=First&names=Last",
                      [('Cookie', 'First=Dinsdale; Last=Piranha;'),
                       ])
-        self.assertHeader('Set-Cookie', 'First=Dinsdale;')
-        self.assertHeader('Set-Cookie', 'Last=Piranha;')
+            self.assertHeader('Set-Cookie', 'First=Dinsdale;')
+            self.assertHeader('Set-Cookie', 'Last=Piranha;')
     
     def testMaxRequestSize(self):
         self.getPage("/", headers=[('From', "x" * 500)])
diff -ur CherryPy-2.2.1/cherrypy/test/webtest.py CherryPy-2.2.1-py2.5/cherrypy/test/webtest.py
--- CherryPy-2.2.1/cherrypy/test/webtest.py	2006-04-25 04:37:40.000000000 +0300
+++ CherryPy-2.2.1-py2.5/cherrypy/test/webtest.py	2008-01-08 23:58:51.000000000 +0200
@@ -204,43 +204,81 @@
     def exit(self):
         sys.exit()
     
-    def __call__(self, result=None):
-        if result is None:
-            result = self.defaultTestResult()
-        result.startTest(self)
-        testMethod = getattr(self, self._TestCase__testMethodName)
-        try:
-            try:
-                self.setUp()
-            except (KeyboardInterrupt, SystemExit):
-                raise
-            except:
-                result.addError(self, self._TestCase__exc_info())
-                return
-            
-            ok = 0
+    if sys.version_info >= (2, 5):
+        def __call__(self, result=None):
+            if result is None:
+                result = self.defaultTestResult()
+            result.startTest(self)
+            testMethod = getattr(self, self._testMethodName)
             try:
-                testMethod()
-                ok = 1
-            except self.failureException:
-                result.addFailure(self, self._TestCase__exc_info())
-            except (KeyboardInterrupt, SystemExit):
-                raise
-            except:
-                result.addError(self, self._TestCase__exc_info())
-            
+                try:
+                    self.setUp()
+                except (KeyboardInterrupt, SystemExit):
+                    raise
+                except:
+                    result.addError(self, self._exc_info())
+                    return
+
+                ok = 0
+                try:
+                    testMethod()
+                    ok = 1
+                except self.failureException:
+                    result.addFailure(self, self._exc_info())
+                except (KeyboardInterrupt, SystemExit):
+                    raise
+                except:
+                    result.addError(self, self._exc_info())
+
+                try:
+                    self.tearDown()
+                except (KeyboardInterrupt, SystemExit):
+                    raise
+                except:
+                    result.addError(self, self._exc_info())
+                    ok = 0
+                if ok:
+                    result.addSuccess(self)
+            finally:
+                result.stopTest(self)
+    else:
+        def __call__(self, result=None):
+            if result is None:
+                result = self.defaultTestResult()
+            result.startTest(self)
+            testMethod = getattr(self, self._TestCase__testMethodName)
             try:
-                self.tearDown()
-            except (KeyboardInterrupt, SystemExit):
-                raise
-            except:
-                result.addError(self, self._TestCase__exc_info())
+                try:
+                    self.setUp()
+                except (KeyboardInterrupt, SystemExit):
+                    raise
+                except:
+                    result.addError(self, self._TestCase__exc_info())
+                    return
+
                 ok = 0
-            if ok:
-                result.addSuccess(self)
-        finally:
-            result.stopTest(self)
-    
+                try:
+                    testMethod()
+                    ok = 1
+                except self.failureException:
+                    result.addFailure(self, self._TestCase__exc_info())
+                except (KeyboardInterrupt, SystemExit):
+                    raise
+                except:
+                    result.addError(self, self._TestCase__exc_info())
+
+                try:
+                    self.tearDown()
+                except (KeyboardInterrupt, SystemExit):
+                    raise
+                except:
+                    result.addError(self, self._TestCase__exc_info())
+                    ok = 0
+                if ok:
+                    result.addSuccess(self)
+            finally:
+                result.stopTest(self)
+
     def assertStatus(self, status, msg=None):
         """Fail if self.status != status."""
         if isinstance(status, basestring):



1.1                  dev-python/cherrypy/files/digest-cherrypy-2.2.1-r2

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-python/cherrypy/files/digest-cherrypy-2.2.1-r2?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-python/cherrypy/files/digest-cherrypy-2.2.1-r2?rev=1.1&content-type=text/plain

Index: digest-cherrypy-2.2.1-r2
===================================================================
MD5 14bf17b0706bc480342cb8fcfaed74cd CherryPy-2.2.1.tar.gz 219932
RMD160 c8f406c5eaedb6f710dc746528b8474df48cb3c8 CherryPy-2.2.1.tar.gz 219932
SHA256 af83ef4f7b6ffabfccea2794cc61ca0f6fabf24c95901b22ea36e5407ffb794b CherryPy-2.2.1.tar.gz 219932



-- 
gentoo-commits@l.g.o mailing list