Blame SOURCES/cobbler-power-vulnerability.patch

1070a0
diff -ru cobbler-2.0.7/cobbler/action_power.py cobbler-2.0.7-new/cobbler/action_power.py
1070a0
--- cobbler-2.0.7/cobbler/action_power.py	2010-07-28 17:48:48.000000000 +0200
1070a0
+++ cobbler-2.0.7-new/cobbler/action_power.py	2012-06-11 11:16:06.409111259 +0200
1070a0
@@ -36,6 +36,7 @@
1070a0
 from cexceptions import *
1070a0
 import templar
1070a0
 import clogger
1070a0
+import shlex
1070a0
1070a0
 class PowerTool:
1070a0
     """
1070a0
@@ -68,8 +69,9 @@
1070a0
         interested in maximum security should take that route.
1070a0
         """
1070a0
 
1070a0
-        template = self.get_command_template()
1070a0
-        template_file = open(template, "r")
1070a0
+        power_command = utils.get_power(self.system.power_type)
1070a0
+        if not power_command:
1070a0
+            utils.die(self.logger,"no power type set for system")
1070a0
 
1070a0
         meta = utils.blender(self.api, False, self.system)
1070a0
         meta["power_mode"] = desired_state
1070a0
@@ -80,35 +82,27 @@
1070a0
         if self.force_pass is not None:
1070a0
            meta["power_pass"] = self.force_pass
1070a0
 
1070a0
-        tmp = templar.Templar(self.api._config)
1070a0
-        cmd = tmp.render(template_file, meta, None, self.system)
1070a0
-        template_file.close()
1070a0
-
1070a0
-        cmd = cmd.strip()
1070a0
-
1070a0
         self.logger.info("cobbler power configuration is:")
1070a0
-
1070a0
         self.logger.info("      type   : %s" % self.system.power_type)
1070a0
         self.logger.info("      address: %s" % self.system.power_address)
1070a0
         self.logger.info("      user   : %s" % self.system.power_user)
1070a0
         self.logger.info("      id     : %s" % self.system.power_id)
1070a0
 
1070a0
         # if no username/password data, check the environment
1070a0
-
1070a0
         if meta.get("power_user","") == "":
1070a0
             meta["power_user"] = os.environ.get("COBBLER_POWER_USER","")
1070a0
         if meta.get("power_pass","") == "":
1070a0
             meta["power_pass"] = os.environ.get("COBBLER_POWER_PASS","")
1070a0
 
1070a0
-        self.logger.info("- %s" % cmd)
1070a0
-
1070a0
-        # use shell so we can have mutliple power commands chained together
1070a0
-        cmd = ['/bin/sh','-c', cmd]
1070a0
+        template = utils.get_power_template(self.system.power_type)
1070a0
+        tmp = templar.Templar(self.api._config)
1070a0
+        template_data = tmp.render(template, meta, None, self.system)
1070a0
+        template_command = shlex.split(str(template_data))
1070a0
 
1070a0
         # Try the power command 5 times before giving up.
1070a0
         # Some power switches are flakey
1070a0
         for x in range(0,5):
1070a0
-            rc = utils.subprocess_call(self.logger, cmd, shell=False)
1070a0
+            rc = utils.subprocess_call(self.logger, template_command, shell=False)
1070a0
             if rc == 0:
1070a0
                 break
1070a0
             else:
1070a0
@@ -119,19 +113,3 @@
1070a0
 
1070a0
         return rc
1070a0
 
1070a0
-    def get_command_template(self):
1070a0
-
1070a0
-        """
1070a0
-        In case the user wants to customize the power management commands, 
1070a0
-        we source the code for each command from /etc/cobbler and run
1070a0
-        them through Cheetah.
1070a0
-        """
1070a0
-
1070a0
-        if self.system.power_type in [ "", "none" ]:
1070a0
-            utils.die(self.logger,"Power management is not enabled for this system")
1070a0
-
1070a0
-        result = utils.get_power(self.system.power_type)
1070a0
-        if not result:
1070a0
-            utils.die(self.logger, "Invalid power management type for this system (%s, %s)" % (self.system.power_type, self.system.name))
1070a0
-        return result
1070a0
-
1070a0
diff -ru cobbler-2.0.7/cobbler/item_system.py cobbler-2.0.7-new/cobbler/item_system.py
1070a0
--- cobbler-2.0.7/cobbler/item_system.py	2010-07-28 17:48:48.000000000 +0200
1070a0
+++ cobbler-2.0.7-new/cobbler/item_system.py	2012-06-11 11:16:06.410111268 +0200
1070a0
@@ -50,11 +50,11 @@
1070a0
   ["virt_auto_boot","<<inherit>>",0,"Virt Auto Boot",True,"Auto boot this VM?",0,"bool"],
1070a0
   ["ctime",0,0,"",False,"",0,"float"],
1070a0
   ["mtime",0,0,"",False,"",0,"float"],
1070a0
-  ["power_type","SETTINGS:power_management_default_type",0,"Power Management Type",True,"",utils.get_power_types(),"str"],
1070a0
+  ["power_type","SETTINGS:power_management_default_type",0,"Power Management Type",True,"Power management script to use",utils.get_power_types(),"str"],
1070a0
   ["power_address","",0,"Power Management Address",True,"Ex: power-device.example.org",0,"str"],
1070a0
-  ["power_user","",0,"Power Username ",True,"",0,"str"],
1070a0
-  ["power_pass","",0,"Power Password",True,"",0,"str"],
1070a0
-  ["power_id","",0,"Power ID",True,"Usually a plug number or blade name, if power type requires it",0,"str"],
1070a0
+  ["power_user","",0,"Power Management Username ",True,"",0,"str"],
1070a0
+  ["power_pass","",0,"Power Management Password",True,"",0,"str"],
1070a0
+  ["power_id","",0,"Power Management ID",True,"Usually a plug number or blade name, if power type requires it",0,"str"],
1070a0
   ["hostname","",0,"Hostname",True,"",0,"str"],
1070a0
   ["gateway","",0,"Gateway",True,"",0,"str"],
1070a0
   ["name_servers",[],0,"Name Servers",True,"space delimited",0,"list"],
1070a0
diff -ru cobbler-2.0.7/cobbler/utils.py cobbler-2.0.7-new/cobbler/utils.py
1070a0
--- cobbler-2.0.7/cobbler/utils.py	2012-06-11 11:19:10.469232289 +0200
1070a0
+++ cobbler-2.0.7-new/cobbler/utils.py	2012-06-11 11:18:39.660541633 +0200
1070a0
@@ -1846,6 +1846,20 @@
1070a0
             return powerpath
1070a0
     return None
1070a0
 
1070a0
+def get_power_template(powertype=None):
1070a0
+    """
1070a0
+    Return power template for type
1070a0
+    """
1070a0
+    if powertype:
1070a0
+        powertemplate = "/etc/cobbler/power/power_%s.template" % powertype
1070a0
+        if os.path.isfile(powertemplate):
1070a0
+            f = open(powertemplate)
1070a0
+            template = f.read()
1070a0
+            f.close()
1070a0
+            return template
1070a0
+    # return a generic template if a specific one wasn't found
1070a0
+    return "action=$power_mode\nlogin=$power_user\npasswd=$power_pass\nipaddr=$power_address\nport=$power_id"
1070a0
+
1070a0
 def get_shared_secret():
1070a0
     """
1070a0
     The 'web.ss' file is regenerated each time cobblerd restarts and is