[patch] tunapie-CVE-2009-1253+1254.patch

tunapie-CVE-2009-1253+1254.patch (text/plain), 3.04 KB, created by Robert Buchholz (RETIRED) on 2009-04-07 23:45:20 UTC

--- tunapie-2.1.8.orig/src/tuner.py
+++ tunapie-2.1.8/src/tuner.py
@@ -26,6 +26,8 @@
 import commands
 import unicodedata
 import time
+import tempfile
+import subprocess
 
 def pkill(program):
     flag=""
@@ -50,7 +52,10 @@
         try: 
             id=str(int(id[0]))
         except:
-            id=str(int(id[1]))
+            try:
+	        id=str(int(id[1]))
+            except:
+	        return found
         commands.getoutput("kill -15 %s" % id)
         if commands.getoutput("ps "+flag+"U "+me+" "+flag+"o pid "+flag+"o command").find(id) > -1:
             commands.getoutput("kill -9 %s" % id)
@@ -212,28 +217,36 @@
         stationbitrate.append(bitrate)
 
 def playselection(mediaplayer,pls,info=0):
-        commands.getoutput("rm -rf /tmp/"+getpass.getuser()+"*_tunapie_temp.pls")
-        tstamp=str(time.time())
-        tempfile=open('/tmp/'+getpass.getuser()+tstamp+'_tunapie_temp.pls','w')
+        temp=tempfile.mkstemp(suffix=".pls")
+        tfile=os.fdopen(temp[0],"w")
+        urldata=urllib.urlopen(pls)
+        notempfile=0
+        if (str(urldata.read(10)).find("playlist")==-1):
+            notempfile=1
+        urldata.close()
         playlist=urllib.urlopen(pls)
         if (info):
+            if notempfile:
+            	os.unlink(temp[1])
+                return[]
             return playlist.readlines()
-        if mediaplayer.find('realplay')>-1:
-            os.system(mediaplayer+" "+pls+" &")
+        if mediaplayer.find('realplay')>-1 or notempfile:
+            subprocess.Popen([mediaplayer,pls])
+            os.unlink(temp[1])
             return
         plist=playlist.readlines()
         if len(plist)==1:
-            os.spawnv(os.P_NOWAIT,commands.getoutput("which "+mediaplayer).split(" ")[0],[mediaplayer,plist[0]])
+            subprocess.Popen([mediaplayer,plist[0]])
             return
         for line in plist:
-            tempfile.write(line)
-        os.spawnv(os.P_NOWAIT,commands.getoutput("which "+mediaplayer).split(" ")[0],[mediaplayer,'/tmp/'+getpass.getuser()+tstamp+'_tunapie_temp.pls'])
+            tfile.write(line)
+        tfile.close()
+        subprocess.Popen([mediaplayer,temp[1]])
+	time.sleep(5)
+        os.unlink(temp[1])
     
 def playvid(mediaplayer,pls):
-    playercommands=mediaplayer.split(" ")
-    vidplayer=commands.getoutput("which "+str(playercommands[0]))
-    playercommands.append(pls)
-    os.spawnv(os.P_NOWAIT, vidplayer, playercommands)
+    subprocess.Popen([mediaplayer, pls])
 
 def savefavorites(home,favname,favurl,favlist,favplay,favbit,favgen,favmod):
     favfile=open(home+'/.tunapie/favorites','w')
@@ -274,12 +287,10 @@
             returnvals[8])
                 
 def recordselection(terminal,args):
-    recordcommand=terminal+args+"&"
-    os.system(recordcommand)
+    subprocess.Popen(terminal+" "+args,shell=True)
 
 def showpage(browser,url):
-    urlcommand=[browser,url]
-    os.spawnv(os.P_NOWAIT,commands.getoutput("which "+browser).split(" ")[0],urlcommand)
+    subprocess.Popen([browser,url])
 
 def adultset():
     try: adultconfig=open('/etc/tunapie.config')