newsbeuter: patch fixing #699

extra-web/newsbeuter/autobuild/patches/CVE-2017-12904.patch

@@ -0,0 +1,16 @@
+diff -Naur newsbeuter-r2.9.orig/src/controller.cpp newsbeuter-r2.9/src/controller.cpp
+--- newsbeuter-r2.9.orig/src/controller.cpp	2015-02-19 18:56:59.000000000 +0800
++++ newsbeuter-r2.9/src/controller.cpp	2017-08-20 12:37:09.797929037 +0800
+@@ -1275,9 +1275,10 @@
+ 	std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
+ 	bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive");
+ 	if (bookmark_cmd.length() > 0) {
+-		std::string cmdline = utils::strprintf("%s '%s' %s %s",
++		std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
+ 		                                       bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(),
+-		                                       stfl::quote(title).c_str(), stfl::quote(description).c_str());
++		                                       utils::replace_all(title,"'", "%27").c_str(),
++		                                       utils::replace_all(description,"'", "%27").c_str());
+
+ 		LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str());
+

extra-web/newsbeuter/spec

@@ -1,2 +1,3 @@
 VER=2.9
+REL=1
 SRCTBL="https://github.com/akrennmair/newsbeuter/archive/r$VER.tar.gz"