Removing leftover import of atomic_move

This reverts commit bd49a835b4.

CHANGELOG.md

@@ -34,6 +34,16 @@ Other notable changes:
 * Inventory speed improvements for very large inventories.
 * Vault password files can now be executable, to support scripts that fetch the vault password.
 
+
+## 1.6.10 "And the Cradle Will Rock" - Jul 25, 2014
+
+- Fixes an issue with the copy module when copying a directory that fails when changing file attributes and the target file already exists
+- Improved unicode handling when splitting args
+
+## 1.6.9 "And the Cradle Will Rock" - Jul 24, 2014
+
+- Further improvements to module parameter parsing to address additional regressions caused by security fixes
+
 ## 1.6.8 "And the Cradle Will Rock" - Jul 22, 2014
 
 - Corrects a regression in the way shell and command parameters were being parsed

RELEASES.txt

@@ -6,6 +6,8 @@ Active Development
 
 1.7    "Summer Nights" -------- SUMMER 2014
 
+1.6.10 "The Cradle Will Rock" - 07-25-2014
+1.6.9  "The Cradle Will Rock" - 07-24-2014
 1.6.8  "The Cradle Will Rock" - 07-22-2014
 1.6.7  "The Cradle Will Rock" - 07-21-2014
 1.6.6  "The Cradle Will Rock" - 07-01-2014

bin/ansible-galaxy

@@ -445,6 +445,7 @@ def install_role(role_name, role_version, role_filename, options):
         # verify the role's meta file
         meta_file = None
         members = role_tar_file.getmembers()
+        # next find the metadata file
         for member in members:
             if "/meta/main.yml" in member.name:
                 meta_file = member
@@ -484,9 +485,16 @@ def install_role(role_name, role_version, role_filename, options):
 
             # now we do the actual extraction to the role_path
             for member in members:
-                # we only extract files
+                # we only extract files, and remove any relative path
+                # bits that might be in the file for security purposes
+                # and drop the leading directory, as mentioned above
                 if member.isreg():
-                    member.name = "/".join(member.name.split("/")[1:])
+                    parts = member.name.split("/")[1:]
+                    final_parts = []
+                    for part in parts:
+                        if part != '..' and '~' not in part and '$' not in part:
+                            final_parts.append(part)
+                    member.name = os.path.join(*final_parts)
                     role_tar_file.extract(member, role_path)
 
             # write out the install info file for later use

lib/ansible/runner/action_plugins/debug.py

@@ -50,7 +50,7 @@ class ActionModule(object):
                 result = dict(failed=True, msg=args['msg'])
             else:
                 result = dict(msg=args['msg'])
-        elif 'var' in args:
+        elif 'var' in args and not utils.LOOKUP_REGEX.search(args['var']):
             results = template.template(self.basedir, "{{ %s }}" % args['var'], inject)
             result[args['var']] = results
 

lib/ansible/runner/connection_plugins/paramiko_ssh.py

@@ -29,7 +29,6 @@ import pipes
 import socket
 import random
 import logging
-import tempfile
 import traceback
 import fcntl
 import re
@@ -381,25 +380,7 @@ class Connection(object):
 
                 self.ssh.load_system_host_keys()
                 self.ssh._host_keys.update(self.ssh._system_host_keys)
-
-                # gather information about the current key file, so
-                # we can ensure the new file has the correct mode/owner
-
-                key_dir  = os.path.dirname(self.keyfile)
-                key_stat = os.stat(self.keyfile)
-
-                # Save the new keys to a temporary file and move it into place
-                # rather than rewriting the file. We set delete=False because
-                # the file will be moved into place rather than cleaned up.
-
-                tmp_keyfile = tempfile.NamedTemporaryFile(dir=key_dir, delete=False)
-                os.chmod(tmp_keyfile.name, key_stat.st_mode & 07777)
-                os.chown(tmp_keyfile.name, key_stat.st_uid, key_stat.st_gid)
-
-                self._save_ssh_host_keys(tmp_keyfile.name)
-                tmp_keyfile.close()
-
-                os.rename(tmp_keyfile.name, self.keyfile)
+                self._save_ssh_host_keys(self.keyfile)
 
             except:
 

lib/ansible/utils/__init__.py

@@ -1257,7 +1257,10 @@ def listify_lookup_plugin_terms(terms, basedir, inject):
         #    with_items: {{ alist }}
 
         stripped = terms.strip()
-        if not (stripped.startswith('{') or stripped.startswith('[')) and not stripped.startswith("/") and not stripped.startswith('set(['):
+        if not (stripped.startswith('{') or stripped.startswith('[')) and \
+           not stripped.startswith("/") and \
+           not stripped.startswith('set([') and \
+           not LOOKUP_REGEX.search(terms):
             # if not already a list, get ready to evaluate with Jinja2
             # not sure why the "/" is in above code :)
             try:

packaging/debian/changelog

@@ -4,6 +4,18 @@ ansible (1.7) unstable; urgency=low
 
  -- Michael DeHaan <michael@ansible.com>  Wed, 07 May 2014 15:00:03 -0500
 
+ansible (1.6.10) unstable; urgency=low
+
+  * 1.6.10 release
+
+ -- Michael DeHaan <michael@ansible.com>  Fri, 25 Jul 2014 13:00:00 -0500
+
+ansible (1.6.9) unstable; urgency=low
+
+  * 1.6.9 release
+
+ -- Michael DeHaan <michael@ansible.com>  Thu, 24 Jul 2014 23:30:00 -0500
+
 ansible (1.6.8) unstable; urgency=low
 
   * 1.6.8 release

packaging/rpm/ansible.spec

@@ -115,6 +115,15 @@ rm -rf %{buildroot}
 
 %changelog
 
+* Wed Aug 06 2014 Michael DeHaan <michael@ansible.com> - 1.7.0
+- Release 1.7.0
+
+* Fri Jul 25 2014 Michael DeHaan <michael@ansible.com> - 1.6.10
+- Release 1.6.10
+
+* Thu Jul 24 2014 Michael DeHaan <michael@ansible.com> - 1.6.9
+- Release 1.6.9
+
 * Tue Jul 22 2014 Michael DeHaan <michael@ansible.com> - 1.6.8
 - Release 1.6.8