Patch

Dirk Nimmich <[email protected]>
Newsgroups gmane.network.tin.devel
Message-ID <[email protected]> 
Attached a patch (against snapshot of 1.9.2) that fixes the "can't
view attachments with illegal encoded filename" bug. I changed the
code so that NO path expansion occurs anymore because of potential
security conflicts (why should it be possible for the external
poster to use environment variable expansion, for example?).


I would have fixed the rot13 decoding bug when viewing the raw
article as well if I'd known what the expected behaviour was. There 
are several possibilities which are all easy to implement, so please
pick the one most wanted:

1. Don't allow rot13 toggling at all when viewing a raw article

   fix in page.c:show_page(), lines 717 - 719:

   add

     if (!show_all_headers) {

   before and

     } else
   	info_message(_(txt_bad_command), printascii(key,
	  func_to_key(GLOBAL_HELP, page_keys)));

   after. The help page, however, would still list the % key.

2. Show all lines in rot13 when viewing a raw article

   fix in page.c:print_message_page(), line 1030:

   - if ((rotate != 0) && (curr->flags & (C_BODY | C_SIG))) {
   + if ((rotate != 0) && ((curr->flags & (C_BODY | C_SIG)) || show_all_headers) {

3. Show only body lines in rot13, but no header lines

   fix in page.c:toggle_raw(), lines 1880 - 1956:

   remember when end of header is reached and change all
   pgart.rawl[j].flags = 0;
   to something like
   pgart.rawl[j].flags = are_we_still_in_header ? 0 : C_BODY;

HTH,
Dirk
192.diff (text/plain, 6.9 KB) 
diff -Nur tin-1.9.2/doc/CHANGES tin-1.9.2-dn/doc/CHANGES
--- tin-1.9.2/doc/CHANGES	2006-06-21 13:42:06.000000000 +0200
+++ tin-1.9.2-dn/doc/CHANGES	2006-09-02 15:14:34.000000000 +0200
@@ -1,5 +1,9 @@
 -- 1.9.2 release 20060621 "" --
 
+U005) Dirk Nimmich <[email protected]>
+      BUG. can't 'V'iew mime-parts with (illegal) encoded filename
+      FIX. proto.h, feed.c, save.c
+
  014) Urs Janssen <[email protected]>  
       BUG. "Kill text pattern" form killfile menu was applied to
            Message-ID and Rrferences instead of Message-ID only
diff -Nur tin-1.9.2/doc/TODO tin-1.9.2-dn/doc/TODO
--- tin-1.9.2/doc/TODO	2006-05-16 16:06:32.000000000 +0200
+++ tin-1.9.2-dn/doc/TODO	2006-09-02 15:13:47.000000000 +0200
@@ -13,15 +13,6 @@
    pass
    [20050816 Urs Janssen <[email protected]>]
 
-o  can 'V'iew mime-parts with (illegal) encoded filename, e.g:
-   | Content-Type: image/jpeg;
-   |  name="=?iso-8859-1?Q?internationales_Zeichen_f=FCr_Ehe.jpg?="
-   | Content-Disposition: attachment;
-   |  filename="=?iso-8859-1?Q?internationales_Zeichen_f=FCr_Ehe.jpg?="
-   as tin treats the leading '=' as mailbox indicator and complains
-   | Save filename for image/jpeg is a mailbox. Attachment not saved
-   [20050203 Urs Janssen <[email protected]>]
-
 o  unexpected multiline responses confuse tin, e.g.:
    | 240 Article posted =?ISO-8859-1?Q?=3C=3D=3Fiso=2D8859=2D1=3Fq=3F=3F=3D87r7k8na?=
    |   =?ISO-8859-1?Q?vt=2Efsf=40urs=2Did=2Etest=2Eka=2Enu=3E?=
diff -Nur tin-1.9.2/include/proto.h tin-1.9.2-dn/include/proto.h
--- tin-1.9.2/include/proto.h	2006-05-30 17:21:51.000000000 +0200
+++ tin-1.9.2-dn/include/proto.h	2006-09-02 14:16:37.000000000 +0200
@@ -3,7 +3,7 @@
  *  Module    : proto.h
  *  Author    : Urs Janssen <[email protected]>
  *  Created   :
- *  Updated   : 2006-05-30
+ *  Updated   : 2006-09-02
  *  Notes     :
  *
  * Copyright (c) 1997-2006 Urs Janssen <[email protected]>
@@ -560,7 +560,6 @@
 /* save.c */
 extern int check_start_save_any_news(int function, t_bool catchup);
 extern t_bool create_path(const char *path);
-extern t_bool expand_save_filename(char *outpath, const char *path);
 extern t_bool post_process_files(t_function proc_type_type, t_bool auto_delete);
 extern t_bool save_and_process_art(t_openartinfo *artinfo, struct t_article *artptr, t_bool is_mailbox, const char *inpath, int max, t_bool post_process);
 extern void decode_save_mime(t_openartinfo *art, t_bool postproc);
diff -Nur tin-1.9.2/src/feed.c tin-1.9.2-dn/src/feed.c
--- tin-1.9.2/src/feed.c	2006-02-15 19:44:37.000000000 +0100
+++ tin-1.9.2-dn/src/feed.c	2006-09-02 15:00:01.000000000 +0200
@@ -3,7 +3,7 @@
  *  Module    : feed.c
  *  Author    : I. Lea
  *  Created   : 1991-08-31
- *  Updated   : 2005-07-02
+ *  Updated   : 2006-09-02
  *  Notes     : provides same interface to mail,pipe,print,save & repost commands
  *
  * Copyright (c) 1991-2006 Iain Lea <[email protected]>
@@ -66,6 +66,7 @@
  * Local prototypes
  */
 static char *get_save_filename(struct t_group *group, int function, char *filename, int filelen, int respnum);
+static t_bool expand_feed_filename(char *outpath, const char *path);
 static t_bool feed_article(int art, int function, struct t_counters *counter, t_bool use_current, const char *data, struct t_group *group);
 static t_function get_feed_key(int function, int level, struct t_group *group, struct t_art_stat *thread, int respnum);
 static t_function get_post_proc_type(void);
@@ -147,6 +148,34 @@
 
 
 /*
+ * Generate a path/filename to save to, using 'path' as input.
+ * The pathname is stored in 'outpath', which should be PATH_LEN in size
+ * Expand metacharacters and use defaults as needed.
+ * Return TRUE if the path is a mailbox, or FALSE otherwise.
+ */
+static t_bool
+expand_feed_filename(
+	char *outpath,
+	const char *path)
+{
+	int ret = strfpath(path, outpath, PATH_LEN, curr_group);
+
+	/*
+	 * If no path exists or the above failed in some way, use sensible defaults
+	 * Put the generic path into 'outpath'
+	 */
+	if ((ret == 0) || !(strrchr(outpath, DIRSEP))) {
+		char buf[PATH_LEN];
+		
+		if (!strfpath(curr_group->attribute->savedir, buf, sizeof(buf), curr_group))
+			joinpath(buf, homedir, DEFAULT_SAVEDIR);
+		joinpath(outpath, buf, path);
+		return FALSE;
+	} else
+		return (ret == 1);
+}
+     
+/*
  * Find out what post-processing to perform.
  * This is not used when saving to mailboxes (we don't postprocess mailboxes)
  * Also not used when using the auto-save feature because a default value is
@@ -625,7 +654,7 @@
 				}
 
 				/* We don't postprocess mailboxen */
-				if ((is_mailbox = expand_save_filename(outpath, savefile)) == TRUE)
+				if ((is_mailbox = expand_feed_filename(outpath, savefile)) == TRUE)
 					pproc_func = POSTPROCESS_NO;
 				else {
 					if (function != FEED_AUTOSAVE && (pproc_func = get_post_proc_type()) == GLOBAL_ABORT)
diff -Nur tin-1.9.2/src/save.c tin-1.9.2-dn/src/save.c
--- tin-1.9.2/src/save.c	2006-05-10 14:42:31.000000000 +0200
+++ tin-1.9.2-dn/src/save.c	2006-09-02 15:24:14.000000000 +0200
@@ -3,7 +3,7 @@
  *  Module    : save.c
  *  Author    : I. Lea & R. Skrenta
  *  Created   : 1991-04-01
- *  Updated   : 2006-02-15
+ *  Updated   : 2006-09-02
  *  Notes     :
  *
  * Copyright (c) 1991-2006 Iain Lea <[email protected]>, Rich Skrenta <[email protected]>
@@ -59,6 +59,7 @@
 static int match_content_type(t_part *part, char *type);
 static t_bool check_save_mime_type(t_part *part, const char *mime_types);
 static t_bool decode_save_one(t_part *part, FILE *rawfp, t_bool postproc);
+static t_bool expand_save_filename(char *outpath, const char *path);
 static void generate_filename(char *buf, int buflen, const char *suffix);
 static void post_process_uud(void);
 static void post_process_sh(void);
@@ -600,26 +601,31 @@
  * Expand metacharacters and use defaults as needed.
  * Return TRUE if the path is a mailbox, or FALSE otherwise.
  */
-t_bool
+static t_bool
 expand_save_filename(
 	char *outpath,
 	const char *path)
 {
-	int ret = strfpath(path, outpath, PATH_LEN, curr_group);
+	char base_filename[PATH_LEN];
+	char buf[PATH_LEN];
+	char buf_path[PATH_LEN];
+	int ret;
 
 	/*
-	 * If no path exists or the above failed in some way, use sensible defaults
-	 * Put the generic path into 'outpath'
+	 * Make sure that externally supplied filename is a filename only and fits
+	 * into buffer
 	 */
-	if ((ret == 0) || !(strrchr(outpath, DIRSEP))) {
-		char buf[PATH_LEN];
+	STRCPY(buf_path, path); base_name(buf_path, base_filename);
 
-		if (!strfpath(curr_group->attribute->savedir, buf, sizeof(buf), curr_group))
-			joinpath(buf, homedir, DEFAULT_SAVEDIR);
-		joinpath(outpath, buf, path);
-		return FALSE;
-	} else
-		return (ret == 1);
+	/* Build default path to save to */
+	if (!(ret = strfpath(curr_group->attribute->savedir, buf, sizeof(buf), curr_group)))
+		joinpath(buf, homedir, DEFAULT_SAVEDIR);
+
+	/* Join path and filename */
+	/* TODO: make sure full path fits into outpath! */
+	joinpath(outpath, buf, base_filename);
+
+	return (ret == 1);	/* should now always evaluate to FALSE */
 }
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.