From: Armin Ronacher <armin.ronacher@active-4.com>
Date: Fri, 6 Jun 2014 16:51:59 +0000 (+0600)
Subject: Merge branch '2.7-maintenance'
X-Git-Tag: 2.8~69
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99e46a07441b7da3d2c5051b50dc8332ab769a2d;p=thirdparty%2Fjinja.git

Merge branch '2.7-maintenance'
---

99e46a07441b7da3d2c5051b50dc8332ab769a2d
diff --cc CHANGES
index b9606f6e,0a1022a8..26bc07e8
--- a/CHANGES
+++ b/CHANGES
@@@ -1,22 -1,13 +1,29 @@@
  Jinja2 Changelog
  ================
  
 +Version 2.8
 +-----------
 +(codename Translation, release date to be decided)
 +
 +- Added `target` parameter to urlize function.
 +- Added support for `followsymlinks` to the file system loader.
 +- The truncate filter now counts the length.
 +- Added equalto filter that helps with select filters.
 +- Changed cache keys to use absolute file names if available
 +  instead of load names.
 +- Fixed loop length calculation for some iterators.
 +- Changed how Jinja2 enforces strings to be native strings in
 +  Python 2 to work when people break their default encoding.
 +- Added :func:`make_logging_undefined` which returns an undefined
 +  object that logs failures into a logger.
 +
+ Version 2.7.3
+ -------------
+ (bugfix release, released on June 6th 2014)
+ 
+ - Security issue: Corrected the security fix for the cache folder.  This
+   fix was provided by RedHat.
+ 
  Version 2.7.2
  -------------
  (bugfix release, released on January 10th 2014)
diff --cc jinja2/bccache.py
index 4c090964,2d28ab8b..2a7df540
--- a/jinja2/bccache.py
+++ b/jinja2/bccache.py
@@@ -227,21 -224,19 +227,29 @@@ class FileSystemBytecodeCache(BytecodeC
  
          dirname = '_jinja2-cache-%d' % os.getuid()
          actual_dir = os.path.join(tmpdir, dirname)
 +
 +        try:
 +            os.mkdir(actual_dir, stat.S_IRWXU)
 +        except OSError as e:
 +            if e.errno != errno.EEXIST:
 +                raise
          try:
 -            os.mkdir(actual_dir, stat.S_IRWXU) # 0o700
 +            os.chmod(actual_dir, stat.S_IRWXU)
 +            actual_dir_stat = os.lstat(actual_dir)
 +            if actual_dir_stat.st_uid != os.getuid() \
 +               or not stat.S_ISDIR(actual_dir_stat.st_mode) \
 +               or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU:
 +                _unsafe_dir()
-         except OSError:
+         except OSError as e:
+             if e.errno != errno.EEXIST:
+                 raise
+ 
+         actual_dir_stat = os.lstat(actual_dir)
+         if actual_dir_stat.st_uid != os.getuid() \
 -                or not stat.S_ISDIR(actual_dir_stat.st_mode) \
 -                or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU:
 -            raise RuntimeError('Temporary directory \'%s\' has an incorrect '
 -	                       'owner, permissions, or type.' % actual_dir)
++           or not stat.S_ISDIR(actual_dir_stat.st_mode) \
++           or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU:
 +            _unsafe_dir()
+ 
          return actual_dir
  
      def _get_cache_filename(self, bucket):
diff --cc setup.py
index 6943f53d,b67af19d..b60bdbbe
--- a/setup.py
+++ b/setup.py
@@@ -35,8 -35,8 +35,6 @@@ For more informations visit the new `Ji
  .. _Jinja2 webpage: http://jinja.pocoo.org/
  .. _documentation: http://jinja.pocoo.org/2/documentation/
  """
--import sys
--
  from setuptools import setup