Use of PYTHONPATH env var in an insecure way

[sylvestre]

A security issue have been reported on the Debian bt:  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605164

As attachement, a fix

[ulidtko]

Moreover, I would say that Guake violates Filesystem Hierarchy Standard by placing .py files under /usr/lib. They should go to /usr/share/pyshared/guake/*.py, and the compiled binary C module should go to /usr/lib/python2.6/dist-packages.

So, the wrong distribution layout causes the need of using PYTHONPATH. This should be fixed, rather then workarounded with alternative substitution.

And furthermore, I have a patch for this; see attachments.

[ulidtko]

python distribution layout patch, part 1

[ulidtko]

python distribution layout patch, part 2

[ulidtko]

python distribution layout patch, part 3

[ulidtko]

python distribution layout patch, part 4

[lincoln]

Hello there,

I agree with ulidtko about the FHS violation and I'm happy to say that I've applied the patches to fix this :)

Thank you!

[sylvestre]

OK, great. Do you have an ETA for a new release with this change ?

If I may comment the change (I am not the author of these commits), it is usually preferred to set the actual author of the patch (the option --author in git allows that).

[lincoln]

Replying to sylvestre:

OK, great. Do you have an ETA for a new release with this change ?

Humm, not yet. I'll start this discussion in the mailing list. I guess it's about the time to happen.

If I may comment the change (I am not the author of these commits), it is usually preferred to set the actual author of the patch (the option --author in git allows that).

I usually apply patches using git-am, this uses all present fields, like Date, Author. Is there any patch that was applied without this info?

[sylvestre]

Sorry, my bad. ;) Trac is wrong on this page: http://guake.org/log/src/globals.py.in?rev=1f7c06378019150870e58554fdb6f2a44d687b81 It says "Author" which it should say "commiter" Sorry for the useless noise!

[pingou]

At the detail of the commit, it differs author from git-author: http://guake.org/changeset/61d67c4d61882188b93f17d901298454dd243ca7/src/globals.py.in