Blame SOURCES/python-jinja2-fix-CVE-2014-1402.patch

a97ff4
--- jinja2/bccache.py.orig	2011-07-12 14:02:32.000000000 +0200
a97ff4
+++ jinja2/bccache.py	2014-05-30 13:15:12.850410773 +0200
a97ff4
@@ -20,6 +20,9 @@
a97ff4
 import tempfile
a97ff4
 import cPickle as pickle
a97ff4
 import fnmatch
a97ff4
+import os
a97ff4
+import errno
a97ff4
+import stat
a97ff4
 try:
a97ff4
     from hashlib import sha1
a97ff4
 except ImportError:
a97ff4
@@ -194,7 +197,9 @@
a97ff4
     two arguments: The directory where the cache items are stored and a
a97ff4
     pattern string that is used to build the filename.
a97ff4
 
a97ff4
-    If no directory is specified the system temporary items folder is used.
a97ff4
+    If no directory is specified a default cache directory is selected.  On
a97ff4
+    Windows the user's temp directory is used, on UNIX systems a directory
a97ff4
+    is created for the user in the system temp directory.
a97ff4
 
a97ff4
     The pattern can be used to have multiple separate caches operate on the
a97ff4
     same directory.  The default pattern is ``'__jinja2_%s.cache'``.  ``%s``
a97ff4
@@ -207,10 +212,39 @@
a97ff4
 
a97ff4
     def __init__(self, directory=None, pattern='__jinja2_%s.cache'):
a97ff4
         if directory is None:
a97ff4
-            directory = tempfile.gettempdir()
a97ff4
+            directory = self._get_default_cache_dir()
a97ff4
         self.directory = directory
a97ff4
         self.pattern = pattern
a97ff4
 
a97ff4
+    def _get_default_cache_dir(self):
a97ff4
+        tmpdir = tempfile.gettempdir()
a97ff4
+
a97ff4
+        # On windows the temporary directory is used specific unless
a97ff4
+        # explicitly forced otherwise.  We can just use that.
a97ff4
+        if os.name == 'nt':
a97ff4
+            return tmpdir
a97ff4
+        if not hasattr(os, 'getuid'):
a97ff4
+            raise RuntimeError('Cannot determine safe temp directory.  You '
a97ff4
+                               'need to explicitly provide one.')
a97ff4
+
a97ff4
+        dirname = '_jinja2-cache-%d' % os.getuid()
a97ff4
+        actual_dir = os.path.join(tmpdir, dirname)
a97ff4
+        try:
a97ff4
+            os.mkdir(actual_dir, stat.S_IRWXU) # 0o700
a97ff4
+        except OSError as e:
a97ff4
+            if e.errno != errno.EEXIST:
a97ff4
+                raise
a97ff4
+
a97ff4
+        actual_dir_stat = os.lstat(actual_dir)
a97ff4
+        if actual_dir_stat.st_uid != os.getuid() \
a97ff4
+                or not stat.S_ISDIR(actual_dir_stat.st_mode) \
a97ff4
+                or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU:
a97ff4
+            raise RuntimeError('Temporary directory \'%s\' has an incorrect '
a97ff4
+                              'owner, permissions, or type.' % actual_dir)
a97ff4
+
a97ff4
+
a97ff4
+        return actual_dir
a97ff4
+
a97ff4
     def _get_cache_filename(self, bucket):
a97ff4
         return path.join(self.directory, self.pattern % bucket.key)
a97ff4