does not check response from fb assumes it is html/xml

Bug #1050793 reported by James Michael DuPont
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
shotwell (Ubuntu)
Fix Released
High
Unassigned
Quantal
Fix Released
High
Unassigned

Bug Description

Impact:
shotwell segfaults on publishing when receiving invalid datas

Test Case:
No good one, fake facebook's server like the submitter or wait on corrupted datas...

Regression potential:
Check that the publishing feature still work correctly

----

Using my facebook fake server, it does not return a valid xml for the token and the software crashes,

github.com:h4ck3rm1k3/photo-librarian-server.git
commit 19527f596c13e20e1debbf7b0b8f6795c4363c8a
Author: James Michael DuPont <email address hidden>
Date: Fri Sep 14 09:39:53 2012 +0200
    checking in because of bug found in shotwell, the document returned is not html and shotwell crashes

STDERR:
[New Thread 0xa4e24b40 (LWP 23752)]
Entity: line 1: parser error : Start tag expected, '<' not found
this_is_a_faked_access_token
^

Revision history for this message
James Michael DuPont (jamesmikedupont) wrote :
Revision history for this message
Adam Dingle (adam-yorba) wrote :

Thanks for the bug report. I've ticketed this upstream at

http://redmine.yorba.org/issues/5822

Changed in shotwell (Ubuntu):
status: New → In Progress
importance: Undecided → Low
Changed in shotwell (Ubuntu Quantal):
status: New → In Progress
importance: Undecided → High
Changed in shotwell (Ubuntu):
importance: Low → High
description: updated
Revision history for this message
Lucas Beeler (lucas-yorba) wrote :

This issue has been fixed upstream; see upstream bug report #5822 here: http://redmine.yorba.org/issues/5822. Shotwell versions 0.13.1 and later include much more robust guards against malformed response data from web servers.

Changed in shotwell (Ubuntu):
status: In Progress → Fix Committed
Changed in shotwell (Ubuntu Quantal):
status: In Progress → Fix Committed
Changed in shotwell (Ubuntu Quantal):
status: Fix Committed → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package shotwell - 0.13.1-0ubuntu2

---------------
shotwell (0.13.1-0ubuntu2) raring; urgency=low

  * Upload to raring

shotwell (0.13.1-0ubuntu1) quantal-proposed; urgency=low

  * New upstream version:
    - "does not check response from fb assumes it is html/xml" (lp: #1050793)
    - Fixes an issue where Shotwell would not include all selected photos
      during a Nautilus "Send To..." export operation (lp: #1002537)
    - Shotwell now properly inhibits the system screensaver when playing a
      slideshow (lp: #1034412)
  * debian/patches/06_uoa.patch: new version update
  * debian/patches/dont_set_hardcoded_libexec.patch: revert upstream change,
    changing the directory this way in a SRU is wrong
 -- Sebastien Bacher <email address hidden> Wed, 07 Nov 2012 17:29:21 +0100

Changed in shotwell (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Chris Halse Rogers (raof) wrote : Please test proposed package

Hello James, or anyone else affected,

Accepted shotwell into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/shotwell/0.13.1-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in shotwell (Ubuntu Quantal):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
Timo Jyrinki (timo-jyrinki) wrote :

Tested that publishing still works fine, but didn't fake the server.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Colin Watson (cjwatson) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package shotwell - 0.13.1-0ubuntu1

---------------
shotwell (0.13.1-0ubuntu1) quantal-proposed; urgency=low

  * New upstream version:
    - "does not check response from fb assumes it is html/xml" (lp: #1050793)
    - Fixes an issue where Shotwell would not include all selected photos
      during a Nautilus "Send To..." export operation (lp: #1002537)
    - Shotwell now properly inhibits the system screensaver when playing a
      slideshow (lp: #1034412)
  * debian/patches/06_uoa.patch: new version update
  * debian/patches/dont_set_hardcoded_libexec.patch: revert upstream change,
    changing the directory this way in a SRU is wrong
 -- Sebastien Bacher <email address hidden> Wed, 31 Oct 2012 16:58:47 +0100

Changed in shotwell (Ubuntu Quantal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.