Bug#791467: plowshare: javascript usage puts user at risk of remote code execution

2015-07-16 Thread Carl Suster
Yes, this is exactly what I'm doing if you take a look at the blocking bugs for this present bug. I've patched the package to remove javascript support and I'm waiting on a mentor to upload to unstable and then approval to upload to stable. I'll work out if there is a viable alternative fix in the

Bug#791467: plowshare: javascript usage puts user at risk of remote code execution

2015-07-16 Thread plowshare4-bug@discard.email
> I am in the process of packaging the new upstream version of plowshare. > There has been a significant change so that the core framework (of shell > scripts) is kept entirely separate to the scripts which use this API to > implement support for specific external sites.   While separating the core

Bug#791467: plowshare: javascript usage puts user at risk of remote code execution

2015-07-12 Thread Carl Suster
Ok, this is my first package in debian so I'm still getting used to things. My thinking is that this package depends on external APIs (the hosting websites) and so it is a good candidate for backports. I hope to be able to add new upstream versions there in addition to unstable. I know that vers

Bug#791467: plowshare: javascript usage puts user at risk of remote code execution

2015-07-12 Thread Felix Geyer
Hi, On Mon, 06 Jul 2015 11:42:55 +1000 Carl Suster wrote: > I am in the process of packaging the new upstream version of plowshare. > There has been a significant change so that the core framework (of shell > scripts) is kept entirely separate to the scripts which use this API to > implement supp

Bug#791467: plowshare: javascript usage puts user at risk of remote code execution

2015-07-05 Thread Carl Suster
I am in the process of packaging the new upstream version of plowshare. There has been a significant change so that the core framework (of shell scripts) is kept entirely separate to the scripts which use this API to implement support for specific external sites. Once this new version is available

Bug#791467: plowshare: javascript usage puts user at risk of remote code execution

2015-07-05 Thread plowshare4-bug@discard.email
Package: plowshare4 Version: 1.0.5-1 Severity: grave Tags: security   (Rationale for severity grave: introduces a security hole allowing access to the accounts of users who use the package. plowshare4 is a command-line tool for downloading files from cyberlocker-type sites. For some sites, this req