From 3aa2024a60c71e02f07d9ad5726c71de0512c6d0 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Mar 03 2017 19:06:48 +0000
Subject: [PATCH 1/2] Switch to using json instead of pickle


Using pickle allows remote code execution.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/tgcaptcha2/model.py b/tgcaptcha2/model.py
index ea0b2c1..50b943a 100644
--- a/tgcaptcha2/model.py
+++ b/tgcaptcha2/model.py
@@ -1,6 +1,6 @@
 from datetime import datetime
 import calendar
-import cPickle
+import json
 import uuid
 
 
@@ -52,11 +52,11 @@ class Captcha(object):
         # pickle is much smaller than the pickled object itself.
         secs = int(calendar.timegm(self.created.utctimetuple()))
         t = (self.plaintext, secs, self.label, self.nonce)
-        return cPickle.dumps(t, cPickle.HIGHEST_PROTOCOL)
+        return json.dumps(t)
 
     def deserialize(cls, serialized_obj):
         "Create a new Captcha object given output from the serialize method."
-        t = cPickle.loads(serialized_obj)
+        t = json.loads(serialized_obj)
         scp = cls()
         scp._plaintext = t[0]
         scp._created = datetime.utcfromtimestamp(t[1])

From 5e7011d0eecf0b7ff09bce50f1235c0ee65f2591 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Mar 09 2017 15:42:27 +0000
Subject: [PATCH 2/2] Bump version


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/tgcaptcha2/release.py b/tgcaptcha2/release.py
index 449ff82..1d189e0 100644
--- a/tgcaptcha2/release.py
+++ b/tgcaptcha2/release.py
@@ -1,6 +1,6 @@
 # Release information about simplecaptcha
 
-version = "0.3.1"
+version = "0.3.2"
 
 description = "A TurboGears CAPTCHA widget for forms."
 long_description = """TGCaptcha2 is a TurboGears widget that provides an easy way to 
@@ -16,8 +16,8 @@ email = "plewis@spamcop.net"
 # copyright = "Vintage 2006 - a good year indeed"
 # Modified by pingou and abadger1999 to allow specifying questions that must
 # be answered
-# Copyright 2016 - Patrick Uiterwijk <patrick@puiterwijk.org>
+# Copyright 2016, 2017 - Patrick Uiterwijk <patrick@puiterwijk.org>
 # if it's open source, you might want to specify these
 #url = "http://code.google.com/p/tgcaptcha/"
-url = "https://fedorahosted.org/tgcaptcha2"
+url = "https://pagure.io/tgcaptcha2"
 license = "MIT"