M gnu/local.mk => gnu/local.mk +0 -1
@@ 889,7 889,6 @@ dist_patch_DATA = \
%D%/packages/patches/luminance-hdr-qt-printer.patch \
%D%/packages/patches/lvm2-static-link.patch \
%D%/packages/patches/lxsession-use-gapplication.patch \
- %D%/packages/patches/lxterminal-CVE-2016-10369.patch \
%D%/packages/patches/make-impure-dirs.patch \
%D%/packages/patches/mars-install.patch \
%D%/packages/patches/mars-sfml-2.3.patch \
M gnu/packages/lxde.scm => gnu/packages/lxde.scm +3 -7
@@ 4,6 4,7 @@
;;; Copyright © 2017 ng0 <contact.ng0@cryptolab.net>
;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
;;; Copyright © 2017 Brendan Tildesley <brendan.tildesley@openmailbox.org>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
;;;
;;; This file is part of GNU Guix.
;;;
@@ 157,21 158,16 @@ toolkit. It allows users to monitor and control of running processes.")
(define-public lxterminal
(package
(name "lxterminal")
- (version "0.3.0")
+ (version "0.3.1")
(source (origin
(method url-fetch)
(uri (string-append "mirror://sourceforge/lxde/LXTerminal"
"%20%28terminal%20emulator%29/LXTerminal%20"
version "/" name "-" version ".tar.xz"))
- (patches (search-patches "lxterminal-CVE-2016-10369.patch"))
(sha256
(base32
- "1yf76s15zvfw0h42b0ay1slpq47khgjmcry8ki2z812zar9lchia"))))
+ "0jrc3m0hbxcmcgahwjlm46s2350gh80ggb6a90xy0h6xqa3z73fd"))))
(build-system gnu-build-system)
- (arguments
- `(;; Tests for "po" fail with "No rule to make target '../src/encoding.c'
- ;; needed by 'lxterminal.pot'. Stop."
- #:tests? #f))
(inputs `(("gtk+" ,gtk+-2)
("vte" ,vte/gtk+-2)))
(native-inputs `(("intltool" ,intltool)
D gnu/packages/patches/lxterminal-CVE-2016-10369.patch => gnu/packages/patches/lxterminal-CVE-2016-10369.patch +0 -37
@@ 1,37 0,0 @@
-Fix CVE-2016-10369:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10369
-
-Patch copied from upstream source repository:
-
-https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648
-
-From f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 Mon Sep 17 00:00:00 2001
-From: Yao Wei <mwei@lxde.org>
-Date: Mon, 8 May 2017 00:47:55 +0800
-Subject: [PATCH] fix: use g_get_user_runtime_dir for socket directory
-
-This bug is pointed out by stackexchange user that putting socket file in
-/tmp is a potential risk. Putting the socket dir in user directory could
-mitigate the risk.
----
- src/unixsocket.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/unixsocket.c b/src/unixsocket.c
-index 4c660ac..f88284c 100644
---- a/src/unixsocket.c
-+++ b/src/unixsocket.c
-@@ -140,7 +140,8 @@ gboolean lxterminal_socket_initialize(LXTermWindow * lxtermwin, gint argc, gchar
- * This function returns TRUE if this process should keep running and FALSE if it should exit. */
-
- /* Formulate the path for the Unix domain socket. */
-- gchar * socket_path = g_strdup_printf("/tmp/.lxterminal-socket%s-%s", gdk_display_get_name(gdk_display_get_default()), g_get_user_name());
-+ gchar * socket_path = g_strdup_printf("%s/.lxterminal-socket-%s", g_get_user_runtime_dir(), gdk_display_get_name(gdk_display_get_default()));
-+ printf("%s\n", socket_path);
-
- /* Create socket. */
- int fd = socket(PF_UNIX, SOCK_STREAM, 0);
---
-2.1.4
-