lp:~lfaraone/pithos/password-permissions-fix

Branch merges

Propose for merging

No branches dependent on this one.

Merged into lp:~kevin-mehall/pithos/trunk at revision 157

Kevin Mehall: Pending requested 2011-04-11

Diff: 104 lines (+62/-3)

2 files modified

bin/pithos (+3/-0)
pithos/PreferencesPithosDialog.py (+59/-3)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #733307: password stored in plaintext in $HOME/.config/pithos.ini

Low

Fix Released

Link a bug report

Related blueprints

158. By Luke Faraone on 2011-04-12

Handle o+rw in one run.

Previously didn't modify the config_perms value, so when we ORd it the second time the changes made the first time were not preserved.

157. By Luke Faraone on 2011-04-11

CVE-2011-1500: Fix password leak to local users through file permissions. (LP: #733307)

On start, check file permissions according to new rules as follows:

  If the file is 0644 and if "unsafe_permissions" is not True,
    chmod 0600
  If the file is world-readable and/or writable (but not exactly 0644) and if
  "unsafe_permissions" is not True:
    chmod o-rw

To override this new behavior, set unsafe_permissions to False in pithos.ini.

On new configuration file creation, set to 0600.

156. By Kevin Mehall on 2011-04-05

Correctly handle hour-long songs. (LP: #734962) Patch by Luke Faraone

155. By Kevin Mehall on 2011-04-05

Apply patch for bug #706681 by Rick Spencer. Fixes "TypeError: could not convert argument to correct param type"

154. By Kevin Mehall on 2011-01-09

Version bump (0.3.7)

153. By Kevin Mehall on 2011-01-09

Only treat QuickMix specially when isCreator is also set (bug #658230)

152. By Kevin Mehall on 2011-01-09

Don't send Pandora ratings to last.fm (bug #636600)

151. By Kevin Mehall on 2011-01-09

os.wait() after webbrowser.open() to avoid zombie process (Fixes bug #670131)

150. By Kevin Mehall on 2011-01-09

Merge delete_feedback branch by Christopher Eby

149. By Kevin Mehall on 2010-11-25

version bump (actually change version number)