X2Go Bug report logs - #575
x2goserver sanitizer arg fix

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: Andrey Igoshin <ai@vsu.ru>

To: submit@bugs.x2go.org

Subject: x2goserver sanitizer arg fix

Date: Mon, 18 Aug 2014 18:44:35 +0400

[Message part 1 (text/plain, inline)]

Package: x2goserver
Version: 4.1.0.0-0~1055~ubuntu14.04.1

x2goserver sanitizer arg fix


details:

# perl -cw Utils.pm 
Scalar value @ARGV[0] better written as $ARGV[0] at Utils.pm line 174.
Scalar value @ARGV[0] better written as $ARGV[0] at Utils.pm line 175.


patch attached.


-- 
Andrey Igoshin <ai@vsu.ru>               Voronezh State University
sip:            ai@vsu.ru                Network Operation Center
phone: +7 473 2281160, ext. 2020         Voronezh, Russia

[x2goserver-sanitizer-arg-fix.diff (text/x-patch, attachment)]

Message #10 received at 575@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 575-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 575@bugs.x2go.org

Subject: X2Go issue (in src:x2goserver) has been marked as pending for release

Date: Wed, 20 Aug 2014 10:18:31 +0200 (CEST)

tag #575 pending
fixed #575 4.1.0.0
thanks

Hello,

X2Go issue #575 (src:x2goserver) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=1f58e7c

The issue will most likely be fixed in src:x2goserver (4.1.0.0).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit 1f58e7ca6fed9c9638fbbe523d023362f83653e3
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Wed Aug 20 10:10:48 2014 +0200

    Fix accessing ARGV in X2Go::Utils:check_x2go_sessionid sub. (Fixes: #575).

diff --git a/debian/changelog b/debian/changelog
index b606fc6..ddac1cd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -53,6 +53,7 @@ x2goserver (4.1.0.0-0x2go1.1) UNRELEASED; urgency=low
     - Re-arrange parameter order of x2gocreatesession and related DB functions.
       Make sure the session ID comes first and we have only optional parameters
       towards the end of the paramter array.
+    - Fix accessing ARGV in X2Go::Utils:check_x2go_sessionid sub. (Fixes: #575).
   * debian/control:
     + Package X2Go::Log in separate package: libx2go-log-perl.
     + Package X2Go::Server::DB in separate package: libx2go-server-db-perl.

Message #22 received at 575@bugs.x2go.org (full text, mbox, reply):

From: X2Go Release Manager X2Go Release Manager <git-admin@x2go.org>

To: 575-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 575@bugs.x2go.org

Subject: X2Go issue (in src:x2goserver) has been marked as closed

Date: Thu, 15 Feb 2018 23:07:20 +0100 (CET)

close #575
thanks

Hello,

we are very hopeful that X2Go issue #575 reported by you
has been resolved in the new release (4.1.0.0) of the
X2Go source project »src:x2goserver«.

You can view the complete changelog entry of src:x2goserver (4.1.0.0)
below, and you can use the following link to view all the code changes
between this and the last release of src:x2goserver.

    http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=fef09acace029b467f45cfbbcb0fc91310bbf90d;hp=1bbfded0225f0790c727cbf2e13e41aa19bee92d

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:x2goserver.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:x2goserver
Version: 4.1.0.0-0x2go1.2
Status: RELEASE
Date: Thu, 15 Feb 2018 23:03:48 +0100
Fixes: 82 86 102 117 121 371 557 575 1047
Changes:
 x2goserver (4.1.0.0-0x2go1.2) RELEASED; urgency=low
 .
   [ Mike Gabriel ]
   * Bump development upstream version to 4.1.0.0.
   * New upstream version (4.1.0.0):
     - Transform x2gologlevel.pm into proper Perl module X2Go::Log.
     - Transform x2godbwrapper.pm into proper Perl module X2Go::Server::DB.
     - Transform x2gosqlitewrapper.pl into small wrapper script and move the
       SQLite3 into Perl package X2Go::Server::DB::SQLite3.
     - Move x2gosqlitewrapper into Perl package X2Go::Server::DB::SQLite3.
     - Move PostgreSQL DB code into Perl package X2Go::Server::DB::PostgreSQL.
     - Move X2Go SQL configuration files (/etc/x2go/x2gosql) into package
       libx2go-server-db-perl.
     - Install /etc/x2go/x2go_logout with its directory x2go_logout.d via
       Makefile installation.
     - Fix new SQLite3 wrapper for db_getmounts Perl call.
     - Fix list output in new SQLite3 wrapper.
     - Make session type label XFCE a valid session that starts xfce4-session.
     - Fix failures of x2gogetagent that was related to faulty regexp in
       SQLite3 DB wrapper script.
     - Add X2Go Server feature X2GO_LIST_SHADOWSESSIONS.
     - Break execution of x2gosuspend-session / x2goterminate-session if the
       script is called without session as first argument and $X2GO_SESSION
       not set. (Fixes: #82).
     - Make x2goruncommand aware of the Cinnamon desktop shell. (Fixes: #117).
     - Fix build-arch target in x2goserver/Makefile. (Fixes: #121).
     - Load config files from a Perl package (X2Go::Config).
     - Disable SupeReNicer by default.
     - Fix session handling for cross-user-account desktop sharing. Now session
       names of desktop sharing session start with the username of the user who
       is requesting the desktop sharing, rather than the username of the person
       who shares his/her desktop.
     - Do not superenice desktop sharing / shadow sessions.
     - Drop obsolete components x2goserver-compat, x2goserver-pyhoca.
     - Makefile: pre-set the PERL_INSTALLDIRS var with ,,vendor''. Use
       pure_install rather than install.
     - Avoid one argument system calls in x2golistshadowsessions.
     - Provide Perl functions to capture stdout/stderr with multi-argument system
       calls.
     - Avoid one argument system calls and backticks in SupeReNicer.
     - Handle situations in SupeReNicer where the agent PID is not set.
     - Start working on an abstraction layer (as Perl
       package X2Go::Server::Agent) that handles all (NX) agent specific actions.
       Move duplicate code into that new Perl package.
     - Security audit of complete code tree, avoid one-argument system calls
       where possible, avoid backticks, use more quotes in shell scripts.
     - Add tunneling port allocation for TeleKinesis framework.
     - Only use teki_* fields with PostgreSQL DB backend if TeKi is enabled.
     - Provide --updatedb feature in x2godbadmin if DB backend is PostgreSQL.
     - Execute post-start.d extension scripts _after_ the session information has
       been submitted to the session DB. This allows execution of
       x2golistsessions and other X2Go commands in post-start.d extension
       scripts.
     - Re-arrange parameter order of x2gocreatesession and related DB functions.
       Make sure the session ID comes first and we have only optional parameters
       towards the end of the parameter array.
     - Fix accessing ARGV in X2Go::Utils:check_x2go_sessionid sub. (Fixes:
       #575).
     - Fix TeKi storing Telekinesis ports in PgSQL-based session DB. Allow
       negative
       port numbers for the case that Telekinesis is not installed.
     - Fix db_insertmount (SQLite). Pathnames must not be enclosed by
       parentheses.
     - Make sure to return "1" in X2Go::Server::DB Perl functions that don't
       return anything by default.
     - Make it possible to change the state of shadow sessions.
     - Provide --debug option for x2gocleansession that allows running
       x2gocleansessions in foreground (and in debug mode).
     - Properly clean up shadow sessions for the session database.
     - Move x2goagent wrapper package around nxagent into X2Go Server.
       (Fixes: #1047).
     - Update execution logic of the x2goagent wrapper script. The script now
       sets the env var $NXAPP and then calls the nxagent wrapper script. For
       this to work properly, the x2goagent symlinks has to be placed into
       directory where the nxagent executable is installed ($LIBDIR/nx/bin/,
       normally).
     - Revisit packaging for latest change in x2goserver-x2goagent. Don't inject
       $(LIBDIR) rather than injecting $(NXLIBDIR) via debian/rules and
       x2goserver.spec.
     - x2goagent wrapper script: Use exec command to launch nxagent. Put "$@" in
       quotes.
   * debian/control:
     + Package X2Go::Log in separate package: libx2go-log-perl.
     + Package X2Go::Server::DB in separate package: libx2go-server-db-perl.
     + x2goserver package: Depend on libx2go-log-perl, libx2go-server-db-perl.
     + Move x2goserver.conf into separate package: x2goserver-common.
     + Use Breaks/Replaces to exchange x2goserver.conf in x2goserver package by
       x2goserver.conf in new x2goserver-common package.
     + Move several x2goserver-* package to x2goserver's Recommends field.
     + Add Reinhard Tartler to Uploaders.
     + Add libcatpure-tiny-perl to Depends: field of libx2go-server-perl.
     + Move x2gosql config to x2goserver-common.
     + Several style and dependency fixes. Use Conflicts: instead of Breaks:
       for unversioned package conflicts.
     + Test if telekinesis-server is installed server-side. If so,
       prepare the telekinesis session sub-directory.
     + Add D (bin:package libx2go-server-db-perl): libswitch-perl.
     + Fix B/R for x2goserver-x2goagent. We need to break/replace x2goagent
       (<< 3.5.99.2~).
     + Nooo... we need to break/replace x2goagent (<< 2:3.5.99.2~).
   * debian/x2goserver.postinst, debian/libx2go-server-db-perl:
     + Handle X2Go session DB creation in x2goserver _and_
       perl-X2Go-Server-DB on postinst.
     - Make sure X2Go session DB files get updated during postinst.
   * debian/libx2go-server-db-perl installation scripts:
     + Remove dpkg-statoverride during remove on prerm, not on purge in postrm.
   * debian/x2goserver.init:
     + Rely on $PATH when invoking x2gocleansessions.
   * debian/x2goserver.service:
     + Provide systemd service file.
   * Move code in pre/post+inst/rm scripts around (from x2goserver package
     to libx2go-server-db-perl and x2goserver-common).
   * debian/copyright:
     + Provide DEP-5 compliant copyright file.
     + Add copyright.in auto-generated file (by licensecheck+CDBS) for later
       reference.
   * debian/x2goserver-x2goagent:
     + Make sure the .features file for x2goserver-x2goagent ends up in its
       bin:pkg.
   * x2goserver.spec:
     + Bring debian/control and x2goclient.spec in sync.
     + Make sure x2godbadmin is evoked from package x2goserver.
     + Handle X2Go session DB creation in x2goserver _and_
       perl-X2Go-Server-DB on postinst.
     + Set buildroot if we build for EPEL-5.
     + Use deprecated %{_initrddir} macro for EPEL-5 builds.
     + Take advantage of native RHEL support (since 4.0.1.10).
     + Install SQLite3 wrapper as setgid x2gouser. (Fixes: 371).
     + Assure that SQLite3 session DB file gets created on install (unless
       PostgreSQL is used as session DB backend).
     + Make sure x2goserver-*.features files do not get installed
       multiple times into various packages.
     + Make sure X2Go Server (x2gocleansessions) starts after installation.
     + Make sure X2Go session DB files get updated during postinst.
     + Require Perl(Switch) (bin:package x2goserver).
     + Don't fail in %post during X2Go session DB creation.
     + Fix call of x2godbadmin --updatedb during package upgrade.
     + Hand over %{_prefix}/%{_libdir}/nx as $NXLIBDIR to x2goserver's Makefiles.
       Required for x2goagent symlink to be properly installed into the same
       folder where the nxagent executable gets installed.
     + Also hand over %{_prefix}/%{_libdir}/nx as $NXLIBDIR when executing make
       install.
     + Add B-R: nxagent. Needed for %{_prefix}/%{_libdir}/nx/bin to be owned.
 .
   [ Guangzhou Nianguan Electronics Technology Co.Ltd. ]
   * New upstream version (4.1.0.0):
     - Add SupeReNicer support.
     - Provide string sanitizers. Esp. a sanitizer for X2Go session IDs.
 .
   [ Otto Kjell ]
   * New upstream version (4.1.0.0):
     - Add markdown files for most of the X2Go Server project folders. (Fixes:
       #102).
     - Fix "server" command line option for x2golistsessions call in
       x2golistdesktops.
 .
   [ Orion Poplawski ]
   * New upstream version (4.1.0.0):
     - Use new script x2gopath in Perl::API. (Fixes: #86).
   * x2goserver.spec:
     - Fix NXLIBDIR path to use %{_libdir} directly.
 .
   [ Oleksandr Shneyder ]
   * New upstream version (4.1.0.0):
     - Fix x2godbadmin. Set right column name "tekidata_port" in create table.
       (Fixes: #557).
     - Unset LD_LIBRARY_PATH for the case when x2gostartagent started from x2godesktopsharing.
 .
   [ Mark Pederson-Cook ]
   * debian/po:
     + Translate DebConf templates to Danish.
 .
   [ Kaan Ozdincer ]
   * debian/po:
     + Translate DebConf templates to Turkish.
 .
   [ Mihai Moldovan ]
   * New upstream version (4.1.0.0):
     - x2goserver/sbin/x2gocleansessions: add timestamp to debug output.
     - x2goserver/sbin/x2gocleansessions: also (correctly) log to syslog if
       started with --debug parameter.
     - libx2go-server-db-perl/lib/libx2go-server-db-sqlite3-wrapper.pl: don't
       use deprecated defined (@array) construct which never really did what one
       would expect (defined () can only be used on scalar values.)
     - x2goserver/bin/x2gofeaturelist: whitespace only.
     - x2goserver-x2goagent/: rename share/x2go/rgb back to etc/rgb.
     - x2goserver-x2goagent/Makefile: install etc/rgb as in
       ${SYSCONFDIR}/x2go/rgb again and create a symlink from that to
       ${DATADIR}/x2go/rgb.
     - x2goserver-x2goagent/Makefile: fix left-over reference to
       share/x2go/rgb. It's back to etc/rgb now.
     - x2goserver-x2goagent/share/x2go/x2gofeature.d/: rename
       x2goserver-agent.features to x2goserver-x2goagent.features.
     - x2goserver/sbin/x2gocleansessions: add -d short parameter for enabling
       debugging capabilities to POD.
     - README.md: whitespace fixes and typo correction.
     - X2Go/Server/DB/SQLite3.pm: fix command name in error messages.
     - X2Go/Utils.pm: backport user name regex changes.
     - x2goserver-x2goagent/etc/x2goagent.options: reenable XFIXES extension.
     - x2goserver/bin/x2gostartagent: fix most other shellcheck warnings, more
       quotes, curly braces et. al.
     - x2goserver/bin/x2goresume-session: fix most other shellcheck warnings,
       more quotes, curly braces et. al.
     - x2goserver/lib: add new perl wrapper script for X2Go::Utils::is_true
       called x2goistrue.
     - x2goserver/bin/x2gostartagent: replace inline perl with calls to
       x2goistrue and x2goqueryconfig.
     - x2goserver/bin/x2gostartagent: support disabling or enabling RANDR
       Xinerama in x2goagent via any parameter in the form randr_xinerama=value
       (with value interpreted by x2goistrue). Note that it is not possible to
       change the RRXinerama preference after a session has been started
       currently.
     - x2goserver/bin/x2gostartagent: pass in xinerama configuration value via
       environment. Doing it via an argument is just asking for trouble since
       we actually have optional parameters.
     - x2goserver/bin/x2gostartagent: add FIXME entry for the SHADREQ_USER
       optional parameter. No client actually uses it and it makes the whole
       parameter handling fragile.
     - x2goserver/bin/x2go{startagent,resume-ression}: instead of disabling
       RANDR Xinerama if no xinerama support has been requested, switch to
       modifying the xinerama nx/nx option. For x2gostartagent, that means a
       variable rename from X2GO_RANDR_XINERAMA to X2GO_XINERAMA with
       essentially the same semantics. For x2goresume-session, a new parameter
       is added.
     - x2goserver/bin/x2gostartagent: disable Xinerama support by default,
       more compatible with the old behavior (and python-x2go/PyHoca).
     - x2goserver/bin/x2go{resume-session,runcommand}: drop obsolete and
       now-unused NX_XINERAMA_CONF variable.
     - x2goserver/lib/x2gogetrandomport: fix function name, leading to startup
       failures.
     - x2goserver/lib/x2go{check,getfree}port: parameter expansion and single
       quotes don't mix well. Use double quotes instead.
     - x2goserver/lib/x2gocheckport: fix X2GO_LIB_PATH -> x2go_lib_path typo.
     - x2goserver/bin/x2gostartagent: output variable expects a string, not an
       integer.
     - x2goserver/lib/x2goistrue: perl strips empty parameters from @ARGV, so
       work around that gracefully.
     - x2goserver/lib/x2goistrue: use shift unconditionally and check the
       parameter to be defined instead.
     - x2goserver/bin/x2goresume-session: handle missing xinerama parameter in
       options string gracefully, skipping that part (and the other optional
       geometry string) correctly.
     - x2goserver-common/Makefile: whitespace (lineup) only.
     - */man/*/*: update dates and version in manpages.
     - */VERSION.*: remove -preview tag.
   * x2goserver.spec:
     - Only create session DB in x2goserver's post install script. Do use
       proper Requires(post) statements to make sure perl-X2Go-Server-DB and
       x2goserver-common are available when x2goserver's post install script is
       being executed. Fixes installation bugs reported by Michael DePaulo.
     - Add support for %{_datadir}/applications symlink in %{_sysconfdir}/x2go.
       + Add creation and deletion bits to %post and %preun scriptlets.
       + Refactor %post, %pre, %postun and %preun scriptlets to accommodate for
         last change.
       + Don't use %{_sbindir} for chkconfig and service on SLE{S,D}.
         %{_sbindir} is a macro for /usr/sbin/, whereas chkconfig and service
         reside in /sbin/.
     - Change deprecated and removed PreReq to Requires(pre) header.
     - Move shadow/shadow-utils/pwdutils Requires to x2goserver-common sub
       package (where they are actually needed.)
     - Re-add etc/rgb as a config file.
     - Correctly create and specify the x2goserver-x2goagent subpackage,
       instead of a standalone x2goagent package.
     - Fix dependency upon versioned nxagent.
     - Let x2goserver depend upon x2goagent-virtual, add Provides: keyword to
       x2goserver-x2goagent (also need to be implemented within X2Go's nx-libs
       master branch.)
     - Add script/symlink ${LIBDIR}/x2go/bin/x2goagent to installed file list.
     - Split up x2gosql installed file list part into actual directories and
       files.
     - Disable stale symlinks check for now (and add comment to re-enable it
       once we've switched to nx-libs 3.5.99 or higher for good.)
     - Actually export NO_BRP_STALE_LINK_ERROR in a correct way/with the
       correct value. Never blindly trust the internets if something looks odd.
     - Add %{_libdir}/x2go/bin as owned directory for x2goserver-x2goagent.
       Also owned by the alternative package x2goagent in nx-libs.
     - Exclude %{_bindir}/x2goagent from being packaged into x2goserver
       package.
     - x2goserver-x2goagent needs nxagent 3.5.99.3 and higher.
     - Actually add logcheck Requires.
     - Give the x2goagent-virtual package a specific version, derived from the
       x2goserver version.
     - Let x2goserver-x2goagent conflict with the former x2goagent package.
     - Let x2goserver depend upon its own x2goserver-virtual package for now.
       The release after that can drop the virtual package again.
     - Add x2goistrue to %files section.
     - Remove useless x2goagent-virtual Provides: and let x2goserver-x2goagent
       obsolete older x2goagent packages.
   * debian/control:
     - Maintainer change in package: X2Go Developers <x2go-dev@lists.x2go.org>.
     - Depend upon newer x2goagent package that now provides the
       x2goagent.options file.
     - Fix nxagent dependency. Must be version 3.5.99.3 or higher. Epoch was
       missing.
     - Dip into cold water and depend solely upon x2goserver-x2goagent in a
       versioned fashion.
   * debian/:
     - Remove x2goserver-x2goagent.dirs and hope it's really unneeded, because
       the Makefile creates these directories correctly.
   * debian/x2goserver-x2goagent.install:
     - Re-add etc/rgb file.
 .
   [ Martti Pitkänen ]
   * debian/po:
     - fi.po: update Finnish DebConf templates translation.

Send a report that this bug log contains spam.