Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 377929 - Urgent stabilization of =media-video/minitube-1.5
Summary: Urgent stabilization of =media-video/minitube-1.5
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Keywording and Stabilization (show other bugs)
Hardware: All Linux
: High enhancement (vote)
Assignee: Qt Bug Alias
URL: https://gitorious.org/minitube/minitu...
Whiteboard:
Keywords: STABLEREQ
Depends on:
Blocks:
 
Reported: 2011-08-05 23:39 UTC by Markos Chandras (RETIRED)
Modified: 2011-08-07 11:25 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
permission error (minitube.opt,1.92 KB, text/plain)
2011-08-06 09:14 UTC, Tomáš "tpruzina" Pružina (amd64 [ex]AT)
Details
permission prob fix (minitube.patch,463 bytes, patch)
2011-08-06 12:45 UTC, Tomáš "tpruzina" Pružina (amd64 [ex]AT)
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Markos Chandras (RETIRED) gentoo-dev 2011-08-05 23:39:03 UTC
This is a zero day stabilization for minitube-1.5. Youtube API changed again, therefore old versions do not work anymore. Please me sure you actually launch the application and play a youtube video. Thanks

Thanks in advanced
Comment 1 Elijah "Armageddon" El Lazkani (amd64 AT) 2011-08-06 00:38:28 UTC
amd64: pass.
Comment 2 Tomáš "tpruzina" Pružina (amd64 [ex]AT) 2011-08-06 08:30:20 UTC
amd64 ok
Comment 3 Tomáš "tpruzina" Pružina (amd64 [ex]AT) 2011-08-06 09:14:15 UTC
Created attachment 282273 [details]
permission error

(In reply to comment #2)
> amd64 ok

Must correct myself, I did some more testing and I ran into following issue
when I ran it as root, exited, rerun as user I got permission error that did not allowed me to view videos.
Comment 4 Markos Chandras (RETIRED) gentoo-dev 2011-08-06 09:51:14 UTC
(In reply to comment #3)
> Created attachment 282273 [details]
> permission error
> 
> (In reply to comment #2)
> > amd64 ok
> 
> Must correct myself, I did some more testing and I ran into following issue
> when I ran it as root, exited, rerun as user I got permission error that did
> not allowed me to view videos.

You are not supposed to run it as root
Comment 5 Tomáš "tpruzina" Pružina (amd64 [ex]AT) 2011-08-06 09:55:34 UTC
(In reply to comment #4)
> (In reply to comment #3)
> > Created attachment 282273 [details]
> > permission error
> > 
> > (In reply to comment #2)
> > > amd64 ok
> > 
> > Must correct myself, I did some more testing and I ran into following issue
> > when I ran it as root, exited, rerun as user I got permission error that did
> > not allowed me to view videos.
> 
> You are not supposed to run it as root

Same problem when I run it as different user, ppl are not supposed to have multiuser machines either?
One way or another, its a bug (it should clean temp files on exit or create uniqe ones for every user).
Comment 6 Markos Chandras (RETIRED) gentoo-dev 2011-08-06 10:13:18 UTC
(In reply to comment #5)
> (In reply to comment #4)
> > (In reply to comment #3)
> > > Created attachment 282273 [details]
> > > permission error
> > > 
> > > (In reply to comment #2)
> > > > amd64 ok
> > > 
> > > Must correct myself, I did some more testing and I ran into following issue
> > > when I ran it as root, exited, rerun as user I got permission error that did
> > > not allowed me to view videos.
> > 
> > You are not supposed to run it as root
> 
> Same problem when I run it as different user, ppl are not supposed to have
> multiuser machines either?
> One way or another, its a bug (it should clean temp files on exit or create
> uniqe ones for every user).

Does the current stable has the same behavior?
Comment 7 Markos Chandras (RETIRED) gentoo-dev 2011-08-06 10:15:26 UTC
@Flavio, could you see if this bug is valid and provide a patch if possible?
Comment 8 Ian Delaney (RETIRED) gentoo-dev 2011-08-06 10:32:10 UTC
amd64:


emerged it, ran a youtube video a little,
rab from a chroot
su -user
$ firefox
browsed to youtube

ran a video in embedded. 

I'm not even sure how or why you'd run a browser as root?
Likely needs a stable host boot.
Comment 9 Markos Chandras (RETIRED) gentoo-dev 2011-08-06 10:35:41 UTC
Your comments about firefox are not relevant to this bug. Please pay attention on what we actually test here
Comment 10 Tomáš "tpruzina" Pružina (amd64 [ex]AT) 2011-08-06 10:58:26 UTC
(In reply to comment #7)
> @Flavio, could you see if this bug is valid and provide a patch if possible?

Can't confirm this in older versions, because problematic tmp file "/tmp/minitube-.mp4" is not being created in 1.4.
Simple shellscript should fix this, I'll write it when im at home and post it.
Comment 11 Tomáš "tpruzina" Pružina (amd64 [ex]AT) 2011-08-06 12:45:04 UTC
Created attachment 282289 [details, diff]
permission prob fix

this patch should fix permission problem (needs testing)
Comment 12 Ian Delaney (RETIRED) gentoo-dev 2011-08-06 14:02:47 UTC
after establishing that we don't know it all,
invoked minitube, no issue with root or user permissions.
It displayed a video list, then could not play them.
any selection lead to cannot get video info.
Comment 13 Markos Chandras (RETIRED) gentoo-dev 2011-08-06 14:38:47 UTC
(In reply to comment #11)
> Created attachment 282289 [details, diff]
> permission prob fix
> 
> this patch should fix permission problem (needs testing)

This can be a possible security issue, since the filename is static. An attacker can create a malicious /tmp/minitube-1.5-{$user,} file and make minitube crash
Comment 14 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-08-07 03:24:22 UTC
x86 stable
Comment 15 Markos Chandras (RETIRED) gentoo-dev 2011-08-07 11:25:21 UTC
I modified the patch to append a random number at the end. I already sent it for review. Also marked stable for amd64 (I hope the fix wont introduce regressions)