Bug#764814: freecad downloads and executes code

2014-11-07 Thread Yorik van Havre
In 0.14 version (the one in debian right now), the preferences option is in Preferences->Draft->DXF instead of Preferences->Import/export->DXF. This is already fixed upstream and will appear correctly in next versions. The message also appears in the FreeCAD UI if you enable/show the output window

Bug#764814: freecad downloads and executes code

2014-11-07 Thread Michal Suchanek
Package: freecad Version: 0.14.3702+dfsg-3 Followup-For: Bug #764814 Hello, I am unable to use DXF files in freecad. In the console(no UI!) there is this message: DXF libraries not found. Downloading... The DXF import/export libraries needed by FreeCAD to handle the DXF format were not found on

Bug#764814: freecad downloads and executes code

2014-10-23 Thread Yorik van Havre
Hi Anton, Actually that Draft_rc.py file is generated after something was changed to some of the UI files. I need to make that happen at compile time some day... In our case here it is necessary because the preferences settings UI was changed to add the possibility to reenable auto downloads. You

Bug#764814: freecad downloads and executes code

2014-10-23 Thread Anton Gladky
Hi Yorik, thanks for the patch! I tried to adopt it for the current Debian freecad version, but you are right, there is a problem to patch Draft_rc.py. Are there really necessary changes in this file which needs to be done to fix the issue? I am considering now to upload the latest git-version of

Bug#764814: freecad downloads and executes code

2014-10-18 Thread Yorik van Havre
Hi Anton, I just committed[1] a fix to this problem. From now on, downloads are disabled by default. The fist time you want to use the DXF import or export feature, the user receives a message explaining him that he needs either to enable automatic downloads, via the freecad preferences settings,

Bug#764814: freecad downloads and executes code

2014-10-17 Thread Yorik van Havre
Okay, I'll try to do that this weekend -- debian-science-maintainers mailing list debian-science-maintainers@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/debian-science-maintainers

Bug#764814: freecad downloads and executes code

2014-10-17 Thread Anton Gladky
Hi Yorik, 2014-10-15 19:36 GMT+02:00 Yorik van Havre : > I wonder if it's not easier to simply disable the > whole DXF import/export, and indicate to users how to add > it themselves. We have not so much time till Debian`s freeze. If you think, there is no "proper" solution let`s disable this fea

Bug#764814: freecad downloads and executes code

2014-10-15 Thread Yorik van Havre
Hi Anton, No, not directly... It's just an example of how to do it. But Francesco doesn't like that solution, and I'm afraid we're again embarking in a long-term issue if I apply the solution from the patch. I wonder if it's not easier to simply disable the whole DXF import/export, and indicate t

Processed: Re: Bug#764814: freecad downloads and executes code

2014-10-15 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: > forwarded 764814 http://freecadweb.org/tracker/view.php?id=1785 Bug #764814 [freecad] freecad downloads and executes code Set Bug forwarded-to-address to 'http://freecadweb.org/tracker/view.php?id=1785'. > thanks Stopping processing here. Please

Bug#764814: freecad downloads and executes code

2014-10-15 Thread Anton Gladky
forwarded 764814 http://freecadweb.org/tracker/view.php?id=1785 thanks Yorik, there is a patch attached on FreeCAD bugtracker. Can it be applied? Thanks Anton 2014-10-11 19:43 GMT+02:00 Yorik van Havre : > Hi, > > This download happens the first time a user wants to use the DXF > import/export

Bug#764814: freecad downloads and executes code

2014-10-14 Thread Francesco Poli
On Mon, 13 Oct 2014 09:38:02 -0300 Yorik van Havre wrote: > > But, above all, the good news is that OpenCASCADE is no longer > > GPL-incompatible [4], hence there's no need to avoid GPL-licensed code > > in freecad now! > > > > Francesco, that is true, but all the solving of the license problems

Bug#764814: freecad downloads and executes code

2014-10-13 Thread Yorik van Havre
Hi Thanks a lot for that example D, it is indeed much simpler than I thought... I change my mind, this now seems a very good solution ;) Would it be enough, though? The final user won't be able to judge... Maybe popping up a dialog the first time, explaining what will happen, would be a good thing

Bug#764814: freecad downloads and executes code

2014-10-12 Thread D Haley
Hi and thanks for the input, I think this bug is less about licencing, which is a large and complex issue, than a quick fix for code execution. Upstream can make their decisions about licencing. This is possibly not a debian question, and i feel somewhat tangential to this bug, and the issues

Bug#764814: freecad downloads and executes code

2014-10-12 Thread Francesco Poli
On Sat, 11 Oct 2014 14:43:30 -0300 Yorik van Havre wrote: > Hi, Hello Yorik, I noticed this bug report and I felt the need to comment. You probably remember me as the one who originally reported the OpenCASCADE licensing issues for the freecad Debian package. If anyone is interested in reading t

Bug#764814: freecad downloads and executes code

2014-10-11 Thread Yorik van Havre
Hi Thanks for the reply These are all pretty complex solutions, any of them will take time to implement I'm afraid. As a short-term solution, the only idea I can come up with is disabling DXF import/export by default and advising users to download and install the required libraries themselves if t

Bug#764814: freecad downloads and executes code

2014-10-11 Thread D Haley
Hi, and thanks for the quick response. I was unaware of the licensing issue - I don't really have an opinion on the licencing problem, but more the technical issue of unsigned code execution. Whilst you/upstream control the resource, freecad doesn't confirm that the download actually comes fro

Bug#764814: freecad downloads and executes code

2014-10-11 Thread Yorik van Havre
Hi, This download happens the first time a user wants to use the DXF import/export feature. Since the license of our DXF exporter is GPL, and other components of FreeCAD prevent from linking to GPL code (namely OpenCasCade and Coin3D) (the whole story is another Debian bug), we found this trick of

Bug#764814: freecad downloads and executes code

2014-10-11 Thread D Haley
Subject: freecad: Downloads and executes code Package: freecad Version: 0.14.3702+dfsg-2 Severity: important Dear Maintainer, As per discussions with the security team, I am marking the severity as grave. Freecad downloads and executes code (e.g. ArchCommands.py) from the network, from https.