Your message dated Sun, 12 Feb 2012 17:03:36 +0000
with message-id <[email protected]>
and subject line Bug#659039: fixed in mumble 1.2.3-3
has caused the Debian Bug report #659039,
regarding mumble: Mumble database is world-readable
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
659039: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659039
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: mumble
Version: 1.2.3-2
Severity: normal
Tags: patch
User: [email protected]
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpbbtG6M/bug_body
By default, Mumble creates it's config file and database with
world-readable permissions. The database may contain passwords.
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/0004-set-file-permissions.patch: Set restrictive
permissions on data files. (LP: #783405)
Thanks for considering the patch.
-- System Information:
Debian Release: wheezy/sid
APT prefers precise-updates
APT policy: (500, 'precise-updates'), (500, 'precise-security'), (500,
'precise-proposed'), (500, 'precise')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-12-generic (SMP w/4 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
diff -Nru mumble-1.2.3/debian/changelog mumble-1.2.3/debian/changelog
diff -Nru mumble-1.2.3/debian/patches/0004-set-file-permissions.patch mumble-1.2.3/debian/patches/0004-set-file-permissions.patch
--- mumble-1.2.3/debian/patches/0004-set-file-permissions.patch 1969-12-31 19:00:00.000000000 -0500
+++ mumble-1.2.3/debian/patches/0004-set-file-permissions.patch 2012-02-07 10:24:47.000000000 -0500
@@ -0,0 +1,42 @@
+Description: Set restrictive permissions on data files.
+Origin: upstream, https://github.com/mumble-voip/mumble/commit/5632c35d6759f5e13a7dfe78e4ee6403ff6a8e3e
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/mumble/+bug/783405
+
+Index: mumble-1.2.3/src/mumble/Database.cpp
+===================================================================
+--- mumble-1.2.3.orig/src/mumble/Database.cpp 2011-02-19 16:35:16.000000000 -0500
++++ mumble-1.2.3/src/mumble/Database.cpp 2012-02-07 10:21:02.398225505 -0500
+@@ -92,6 +92,11 @@
+ qWarning("Database: Database is read-only");
+ }
+
++ {
++ QFile f(db.databaseName());
++ f.setPermissions(f.permissions() & ~(QFile::ReadGroup | QFile::WriteGroup | QFile::ExeGroup | QFile::ReadOther | QFile::WriteOther | QFile::ExeOther));
++ }
++
+ QSqlQuery query;
+
+ query.exec(QLatin1String("CREATE TABLE IF NOT EXISTS `servers` (`id` INTEGER PRIMARY KEY AUTOINCREMENT, `name` TEXT, `hostname` TEXT, `port` INTEGER DEFAULT 64738, `username` TEXT, `password` TEXT)"));
+Index: mumble-1.2.3/src/mumble/Settings.cpp
+===================================================================
+--- mumble-1.2.3.orig/src/mumble/Settings.cpp 2011-02-19 16:35:17.000000000 -0500
++++ mumble-1.2.3/src/mumble/Settings.cpp 2012-02-07 10:21:02.398225505 -0500
+@@ -698,6 +698,17 @@
+ void OverlaySettings::save(QSettings* settings_ptr) {
+ OverlaySettings def;
+
++ settings_ptr->setValue(QLatin1String("version"), QLatin1String(MUMTEXT(MUMBLE_VERSION_STRING)));
++ settings_ptr->sync();
++
++#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
++ if (settings_ptr->format() == QSettings::IniFormat)
++#endif
++ {
++ QFile f(settings_ptr->fileName());
++ f.setPermissions(f.permissions() & ~(QFile::ReadGroup | QFile::WriteGroup | QFile::ExeGroup | QFile::ReadOther | QFile::WriteOther | QFile::ExeOther));
++ }
++
+ SAVELOAD(bEnable, "enable");
+
+ SAVELOAD(osShow, "show");
--- End Message ---
--- Begin Message ---
Source: mumble
Source-Version: 1.2.3-3
We believe that the bug you reported is fixed in the latest version of
mumble, which is due to be installed in the Debian FTP archive:
mumble-11x_1.2.3-3_amd64.deb
to main/m/mumble/mumble-11x_1.2.3-3_amd64.deb
mumble-dbg_1.2.3-3_amd64.deb
to main/m/mumble/mumble-dbg_1.2.3-3_amd64.deb
mumble-server-web_1.2.3-3_all.deb
to main/m/mumble/mumble-server-web_1.2.3-3_all.deb
mumble-server_1.2.3-3_amd64.deb
to main/m/mumble/mumble-server_1.2.3-3_amd64.deb
mumble_1.2.3-3.debian.tar.gz
to main/m/mumble/mumble_1.2.3-3.debian.tar.gz
mumble_1.2.3-3.dsc
to main/m/mumble/mumble_1.2.3-3.dsc
mumble_1.2.3-3_amd64.deb
to main/m/mumble/mumble_1.2.3-3_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Patrick Matthäi <[email protected]> (supplier of updated mumble package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 12 Feb 2012 17:09:07 +0100
Source: mumble
Binary: mumble mumble-11x mumble-server mumble-dbg mumble-server-web
Architecture: source all amd64
Version: 1.2.3-3
Distribution: unstable
Urgency: high
Maintainer: Debian VoIP Team <[email protected]>
Changed-By: Patrick Matthäi <[email protected]>
Description:
mumble - Low latency VoIP client
mumble-11x - Low latency VoIP client (1.1.x)
mumble-dbg - Low latency VoIP client (debugging symbols)
mumble-server - Low latency VoIP server
mumble-server-web - Web scripts for mumble-server
Closes: 627139 657632 659039
Changes:
mumble (1.2.3-3) unstable; urgency=high
.
* Add Dutch debconf translation.
Closes: #657632
* Add patch 01-fix-spelling-error.diff to fix an minor spelling error in
the source code.
* Add patch 05-lsb-description which fixes the lintian warning
init.d-script-missing-lsb-description.
* Add patch 02-reject-with-ip-in-log to show up the IP address of a rejected
connection in the mumble-server log.
Closes: #627139
* Add patch 04-set-file-permissions from Marc Deslauriers, which fixes the
file permissions of the Mumble database.
Closes: #659039
Checksums-Sha1:
e8b11e39f40daebf905ec2ef1a3e4adc0a8d0d3d 2851 mumble_1.2.3-3.dsc
93262d433674c88dfa2a1949a854570ef51d84b3 34433 mumble_1.2.3-3.debian.tar.gz
e7645409458b0d5ddcddb60e47dd8091a7e9fc2b 115914
mumble-server-web_1.2.3-3_all.deb
dcf17cc6a178f0bd23e4189e7d0d9e7b0a1faa44 2639066 mumble_1.2.3-3_amd64.deb
2cee1c2befc42641f65ffb8fd860cb80006b72a4 1300988 mumble-11x_1.2.3-3_amd64.deb
ce987e48b5ef398376bf2f5d4390a6f26ebbde8e 860764 mumble-server_1.2.3-3_amd64.deb
ba5ed404362d8741fad3b8b33954ce569e74249d 39858282 mumble-dbg_1.2.3-3_amd64.deb
Checksums-Sha256:
2b7738cd117bac1ce97d26b0fa999aa862e3020915c133e148fc7779c9b10d19 2851
mumble_1.2.3-3.dsc
d674d4e83fe07b8151649e94aa32ca8fac752308d18c53e15f2e8d3df525b7c2 34433
mumble_1.2.3-3.debian.tar.gz
91279d47d1dc9fc00f31592b3fe154724c7a8b87f596a18153e56aee8486f23e 115914
mumble-server-web_1.2.3-3_all.deb
5b83d025fbffe4e4319a45cb7792719d3dc6b1b459684935986ad422d1a2eff6 2639066
mumble_1.2.3-3_amd64.deb
2cb16c434f96aaaf6951e8e754e8648ff50232d645d6aeab96ae9483a862bc89 1300988
mumble-11x_1.2.3-3_amd64.deb
17c7adae151a33bbbc9637d1612b21a394c9ce9d991d47ecb71430fbd3c53801 860764
mumble-server_1.2.3-3_amd64.deb
704d4b6edf7f030ab5bee46534d572afff7fca1e14c84178bbe6096f8c8cfffa 39858282
mumble-dbg_1.2.3-3_amd64.deb
Files:
b987f9e00b97f0f8414dff7122ed2b8c 2851 sound optional mumble_1.2.3-3.dsc
ef187f85c2eed00df2ef6ebb5c019b93 34433 sound optional
mumble_1.2.3-3.debian.tar.gz
67395ac00c09b7efbd7a478845fb68ce 115914 sound optional
mumble-server-web_1.2.3-3_all.deb
445e9cec3df5cfb0c77519b9fb11364c 2639066 sound optional
mumble_1.2.3-3_amd64.deb
4fc5784a9a2c56525a2bff596caff5b4 1300988 sound optional
mumble-11x_1.2.3-3_amd64.deb
32670488a13cf0bb1f9cac278ea4b246 860764 sound optional
mumble-server_1.2.3-3_amd64.deb
525dd78aa7cb043053fbc3a5f90b9dce 39858282 debug extra
mumble-dbg_1.2.3-3_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBCAAGBQJPN+e+AAoJEBLZsEqQy9jkyYMQAJVJz2bhD4cxHPUJbHClThVd
N/50S5j8uD9osy90UUHNoAP3+Fu/SEKy/FIfjp4eokFT2VZi6uQDIm94HiGeMumD
hmME8M/k8vF5Ks9G+5cBlE6xJXdlh2d0AnoOVZtWhFIkOur4xLHvIHRTrGn3QwCk
PH3ffJktWAVrB0x1UNF6GejemvOzkhtzrT3k+jEGgw7heQdjkd8LXPLDf455aOSo
A2HN+u8tAj5O73Bdw7yVCBtKcQLgJVYoPCWmdTsm4p0q2GH9ZT31Oc9lpetMOcCX
643E6FmoXHC3h4ZvN5Vu377pchXaEYry9eR/k8IEp/pnvjk1vUf2F2kUoitvXWOd
Vza3idbXnkB6wjejGQLyDeybCTCiMA4QFocigrIXhIfacwYCHMzAt94FYx5pfF9e
sDa+5bpnGUdZY9ir35pw4l7cBCz8CvM+hwOtBvKvXCVN6ALwbnVvS1lLO2KXKc3N
xmGGpcNUPj98MA+DcuwDPfViUrwyV0DqCMT7Q/wLaIyDVqt/iaVExHDszLlJ/o4w
kXsVJ8RgOlHGZ/Q4lCR7mmnxG8/R4o2EnSifNkU1bCrA7aBFlwCgqypNV+mRVXdx
9CGtsYKhCVMZW7bav3H9gMbkdyEhg8eJly1/jvZit721swGwAzbJ/eKwZwX4lfLR
k4iH16tnyOJTML5DYav/
=dW3+
-----END PGP SIGNATURE-----
--- End Message ---
