[MIR] ajaxterm

The defaults are to use ssh to localhost host, and to only listen for connections on localhost. Using this without encryption would be considered a critical security issue, as it would expose the entire underlying SSH connection. As long as ajaxterm is never used in this way, I'm fine with including it.

Can you eliminate "usr/share/python" and it's entire tree? It doesn't seem to be needed. Additionally, can you see why the sys.path is adjusted at the start of ajaxterm.py itself? I don't think that should be needed and might be dangerous depending on how it is called.

1. path adjustment: I see no reason for it -- the code goes this way:

 (...)
 20 os.chdir(os.path.normpath(os.path.dirname(__file__)))
 21 # Optional: Add QWeb in sys path
 22 sys.path[0:0]=glob.glob('../../python')
 23
 24 import qweb, codecs
(...)

the python script is located at /usr/share/ajaxterm/. There is no such directory (from the current path) as '../../python', so the 'glob.glob()' call returns an empty list. Additionally, qweb.py is in the same directory as the script. I am guessing this is a left-over.

2. remove /ush/share/python/runtime.d -- I added a 'override_dh_auto_install' on debian/rules, removing the directory subtree.

Argh. After a lot of pain I found the correct place to override the ./python/runtime.d/ maintainer scripts -- just after dh_python2, on the build process.

I think it is right now, at least works for me.

Patch looks good, thanks!

With these changes, I'm okay with the MIR. +1

This bug was fixed in the package ajaxterm - 0.10-11ubuntu1

---------------
ajaxterm (0.10-11ubuntu1) oneiric; urgency=low

  * Resolutions for issues outlined in MIR (LP: #795159, Closes: 638332):
    + debian/patches/93_bug795159.diff: removed add to sys.path at beginning
      of the code (unneeded, potential security issue).
    + debian/rules: delete auto-installed /usr/share/python/runtime.d.
 -- C de-Avillez <email address hidden> Wed, 17 Aug 2011 12:29:51 -0500

2011-08-18 21:11:17 INFO Override Component to: 'main'
2011-08-18 21:11:17 INFO 'ajaxterm - 0.10-11ubuntu1/universe/web' source overridden
2011-08-18 21:11:18 INFO 'ajaxterm-0.10-11ubuntu1/universe/web/OPTIONAL' binary overridden in oneiric/amd64
2011-08-18 21:11:18 INFO 'ajaxterm-0.10-11ubuntu1/universe/web/OPTIONAL' binary overridden in oneiric/armel
2011-08-18 21:11:18 INFO 'ajaxterm-0.10-11ubuntu1/universe/web/OPTIONAL' binary overridden in oneiric/i386
2011-08-18 21:11:18 INFO 'ajaxterm-0.10-11ubuntu1/universe/web/OPTIONAL' binary overridden in oneiric/powerpc

Hi,

Please note that ajaxterm hasn't been maintained upstream for some years (the original maintainer is unreachable).

As for your patch, while I totally agree as for the sys.path call, the runtime.d script is used in case of a default python runtime change (see Debian python policy section 1.6 : http://www.debian.org/doc/packaging-manuals/python-policy/ch-python.html#s-runtimes_hooks)

I'll thus only apply the first part of your patch to the Debian package (see Debian bug #638332), thanks for sharing it

Cheers,
Julien

@Julien, Thanks for following up on this, it is most appreciated.