gnu: newsbeuter: Deprecate in favour of newsboat.

* gnu/packages/syndication.scm (newsbeuter): Redefine using
‘deprecated-package’.
* gnu/packages/patches/newsbeuter-CVE-2017-12904.patch: Delete file.
* gnu/packages/patches/newsbeuter-CVE-2017-14500.patch: Likewise.
* gnu/local.mk (dist_patch_DATA): Remove both.

2 files changed, 0 insertions, 77 deletions

diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch b/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch
deleted file mode 100644
index 8e90502469..0000000000
--- a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-Fix CVE-2017-12904:
-
-https://github.com/akrennmair/newsbeuter/issues/591
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12904
-
-Patch copied from the Debian package of newsbeuter, version 2.9-5+deb9u1.
-
-Adapted from upstream source repository:
-
-https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
-
-Description: Fix a RCE vulnerability in the bookmark command
- Newsbeuter didn't properly escape the title and description fields before
- passing them to the bookmarking program which could lead to remote code
- execution using the shells command substitution functionality (e.g. "$()", ``,
- etc)
-
-Origin: upstream, https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
-Last-Update: 2017-08-18
-
---- newsbeuter-2.9.orig/src/controller.cpp
-+++ newsbeuter-2.9/src/controller.cpp
-@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s
- 	std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
- 	bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive");
- 	if (bookmark_cmd.length() > 0) {
--		std::string cmdline = utils::strprintf("%s '%s' %s %s",
-+		std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
- 		                                       bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(),
--		                                       stfl::quote(title).c_str(), stfl::quote(description).c_str());
-+		                                       utils::replace_all(title,"'", "%27").c_str(),
-+		                                       utils::replace_all(description,"'", "%27").c_str());
- 
- 		LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str());
diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch b/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch
deleted file mode 100644
index 449105e42a..0000000000
--- a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333.patch
-http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14500
-
-From 26f5a4350f3ab5507bb8727051c87bb04660f333 Mon Sep 17 00:00:00 2001
-From: Alexander Batischev <eual.jp@gmail.com>
-Date: Sat, 16 Sep 2017 19:31:43 +0300
-Subject: [PATCH] Work around shell code in podcast names (#598)
-
----
- src/pb_controller.cpp | 6 +++---
- src/queueloader.cpp   | 2 +-
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
-index 09b5e897..213216cd 100644
---- a/src/pb_controller.cpp
-+++ b/src/pb_controller.cpp
-@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) {
- 	if (player == "")
- 		return;
- 	cmdline.append(player);
--	cmdline.append(" \"");
--	cmdline.append(utils::replace_all(file,"\"", "\\\""));
--	cmdline.append("\"");
-+	cmdline.append(" \'");
-+	cmdline.append(utils::replace_all(file,"'", "%27"));
-+	cmdline.append("\'");
- 	stfl::reset();
- 	LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str());
- 	::system(cmdline.c_str());
-diff --git a/src/queueloader.cpp b/src/queueloader.cpp
-index c1dabdd8..ae725e04 100644
---- a/src/queueloader.cpp
-+++ b/src/queueloader.cpp
-@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) {
- 		strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
- 		fn.append(lbuf);
- 	} else {
--		fn.append(base);
-+		fn.append(utils::replace_all(base, "'", "%27"));
- 	}
- 	return fn;
- }