[tryton-debian-vcs] tryton-server branch debian-stretch-3.8 updated. debian/3.8.10-1-2-g5b1f27f

[Mathias Behrle]

The following commit has been merged in the debian-stretch-3.8 branch:
https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi/?p=tryton/tryton-server.git;a=commitdiff;h=debian/3.8.10-1-2-g5b1f27f

commit 5b1f27f484526a6e33b59b7eb81c1da2a36751c3
Author: Mathias Behrle <mathiasb at m9s.biz>
Date:   Tue Apr 4 09:44:00 2017 +0200

    Releasing debian version 3.8.11-1.
    
    Signed-off-by: Mathias Behrle <mathiasb at m9s.biz>

diff --git a/debian/changelog b/debian/changelog
index d4a2f6e..17cdf58 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+tryton-server (3.8.11-1) unstable; urgency=medium
+
+  * Merging upstream version 3.8.11.
+
+ -- Mathias Behrle <mathiasb at m9s.biz>  Tue, 04 Apr 2017 09:44:00 +0200
+
 tryton-server (3.8.10-1) unstable; urgency=medium
 
   * Add the actual upstream maintainer key to signing-key.asc.
commit 8fc2220dd2e6d2869bf4d49499113928655883e6
Author: Mathias Behrle <mathiasb at m9s.biz>
Date:   Tue Apr 4 09:43:59 2017 +0200

    Merging upstream version 3.8.11.

diff --git a/CHANGELOG b/CHANGELOG
index 6eaff95..647df48 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,7 @@
+Version 3.8.11 - 2017-04-03
+* Bug fixes (see mercurial logs for details)
+* Sanitize path in file_open against suffix (CVE-2017-0360)
+
 Version 3.8.10 - 2017-03-10
 * Bug fixes (see mercurial logs for details)
 
diff --git a/PKG-INFO b/PKG-INFO
index 2f16d64..a64e811 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: trytond
-Version: 3.8.10
+Version: 3.8.11
 Summary: Tryton server
 Home-page: http://www.tryton.org/
 Author: Tryton
diff --git a/trytond.egg-info/PKG-INFO b/trytond.egg-info/PKG-INFO
index 2f16d64..a64e811 100644
--- a/trytond.egg-info/PKG-INFO
+++ b/trytond.egg-info/PKG-INFO
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: trytond
-Version: 3.8.10
+Version: 3.8.11
 Summary: Tryton server
 Home-page: http://www.tryton.org/
 Author: Tryton
diff --git a/trytond/__init__.py b/trytond/__init__.py
index 08821dd..6a7efe5 100644
--- a/trytond/__init__.py
+++ b/trytond/__init__.py
@@ -4,7 +4,7 @@ import os
 import time
 from email import charset
 
-__version__ = "3.8.10"
+__version__ = "3.8.11"
 
 os.environ['TZ'] = 'UTC'
 if hasattr(time, 'tzset'):
diff --git a/trytond/tools/misc.py b/trytond/tools/misc.py
index a5cfab0..958c96a 100644
--- a/trytond/tools/misc.py
+++ b/trytond/tools/misc.py
@@ -60,7 +60,7 @@ def file_open(name, mode="r", subdir='modules'):
         "Join paths and ensure it still below root"
         path = os.path.join(root, *paths)
         path = os.path.normpath(path)
-        if not path.startswith(root):
+        if not path.startswith(os.path.join(root, '')):
             raise IOError("Permission denied: %s" % name)
         return path
 
-- 
tryton-server