Please sync safe-rm 0.3-1 (universe) from Debian unstable (main)

Bug #269203 reported by François Marier
4
Affects Status Importance Assigned to Milestone
safe-rm (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: safe-rm

Please sync safe-rm 0.3-1 (universe) from Debian unstable (main).

Changelog since current intrepid version 0.2-5:

safe-rm (0.3-1) unstable; urgency=low

  * New Upstream Version:
    - Better protection for files in the current directory

 -- Francois Marier <email address hidden> Tue, 09 Sep 2008 19:12:21 +1200

safe-rm (0.2-6) unstable; urgency=low

  * Stop referring to /bin/rm in the package description
  * Add Turkish debconf translation (closes: #490085)
  * Add French debconf translation (closes: #490194)
  * Add Portugese debconf translation (closes: #490237)
  * Add Galician debconf translation (closes: #490387)
  * Add Czech debconf translation (closes: #490581)
  * Add Finnish debconf translation (closes: #490629)
  * Add German debconf translation (closes: #490703)
  * Add Swedish debconf translation (closes: #490798)
  * Add Basque debconf translation (closes: #491003)
  * Add Vietnamese debconf translation (closes: #491050)
  * Add Russian debconf translation (closes: #491341)

 -- Francois Marier <email address hidden> Thu, 24 Jul 2008 16:41:37 +1200

Revision history for this message
François Marier (fmarier) wrote :

(I'm both the Debian maintainer and upstream for this project)

I believe that the bug that was fixed in 0.3 is quite important. Without this fix, the protection guaranteed by this package can be much smaller than what people would expect.

For example, on 0.2, even if you blacklist the file '/home/username/todo.txt', typing "rm todo.txt" in your home directory will delete the file.

So technically, this bug doesn't make the package unusable, but it can be argued that it makes it quite a bit less useful.

Anyways, aside from the debconf translations and the slight alteration to the package description, the difference between intrepid and Debian unstable is a one-line fix to /usr/bin/safe-rm:

--- a/safe-rm

+++ b/safe-rm

@@ -131,7 +131,7 @@ for (my $i = 0; $i <= $#ARGV; $i++) {

     # Normalize the pathname

     my $normalized_pathname = $pathname;

- if ($normalized_pathname =~ m|/|) {

+ if ($normalized_pathname =~ m|/| or -e "$normalized_pathname") {

         # Convert to an absolute path (e.g. remove "..")

         $normalized_pathname = realpath($normalized_pathname);

         $normalized_pathname = $pathname unless $normalized_pathname;

Hence I would highly recommend that this package by synced before intrepid is released.

Francois

Revision history for this message
Daniel Holbach (dholbach) wrote : ACK of sync request

ACKed.

Revision history for this message
Steve Langasek (vorlon) wrote :

[Updating] safe-rm (0.2-5 [Ubuntu] < 0.3-1 [Debian])
 * Trying to add safe-rm...
  - <safe-rm_0.3-1.dsc: downloading from http://ftp.debian.org/debian/>
  - <safe-rm_0.3-1.diff.gz: downloading from http://ftp.debian.org/debian/>
  - <safe-rm_0.3.orig.tar.gz: downloading from http://ftp.debian.org/debian/>
I: safe-rm [universe] -> safe-rm_0.2-5 [universe].

Changed in safe-rm:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.