- Inkscape Devel - Inkscape Mailman

"make dist" fails
by Kees Cook 21 Mar '07

21 Mar '07

Some mingw stuff seems to be a bit off, but I didn't track it down: .... + make dist cd . && /bin/bash /scratch/ink-debs/inkscape/trunk/missing --run autoheader touch ./config.h.in make: *** No rule to make target `config.h.mingw', needed by `distdir'. Stop. -- Kees Cook @outflux.net

2 2

CorelDRAW Import
by Gail Banaszkiewicz 21 Mar '07

21 Mar '07

Random thought. I was thinking about the CorelDRAW import SoC project, and assuming to myself it may be best to stay away, since the potential IP problems *may* be even worse than working on text (which may actually be generic enough to not have to worry). HOWEVER I want you guys to know that I can help put together a bunch of test files, and even test the code of whoever ends up working on it (SoC or not). So don't forget! Gail

2 2

Ping (SoC)
by Eric Sumner 21 Mar '07

21 Mar '07

I'm here, like several others, because of Google's SoC. I am a Master's student in Mechanical Engineering at Southern Methodist University. I have kept an eye on Inkscape for several years, but I have only rarely had occasion to use it. I, like everyone else here (it seems), am interested in adding facilities that will make Inkscape easier to use to make 3D drawings. Being an engineer, I am also interested in being able to use it to make orthographic drawings. Aside from the 3D box tool, there are several features that might prove useful for 3D drawing: 1) Isometric/Axiometric grid 2) Diagonal guides (converging to a vanishing point) 3) Drawing with a prespecified transformation 4) Make Ctrl-dragging a node observe the object's transformation matrix 5) Perspective transformation (this would require somehow extending SVG's transformation mechanism) 6) Support for snapping non-node corners of rectangles I would be happy to work on any of these features over the summer. The usefulness of the first two seem obvious (to me), but the rest may take some explaining. Being able to set a transformation before you start drawing would allow you to, for example, set up drawing top faces for an isometric drawing, and have the rectangle tool work properly for those faces. Similarly, it would be useful to have a convenient way to move a node only along the basis vectors of an object's coordinate space, thus moving horizontally and vertically in the conceptual image. In conjunction with the previous two items, a perspective transformation would allow the same manipulations of orthographic images to be applied to perspective images. As for (6), this is usually taken care of by bounding-box snapping, but that doesn't work when the rectangle has undergone a transformation, making its corners not at the corners of its bounding box. Also, for bug #1674596, would an acceptable replacement for "Export Bitmap..." be "Render to File..."? This seems like an ideal bug for me to figure out the patch submission process because the change is only one line (I think; I haven't been able to test it yet). -- Eric Sumner

5 6

splash screen for 0.45.1
by momo 20 Mar '07

20 Mar '07

Hi! Since 0.45.1 is now out, I have a question about http://sourceforge.net/tracker/index.php?func=detail&aid=1683252&group_id=9… Has it been used and I should close it, or should I delete this patch? Thanks! Molumen I'm protected by SpamBrave http://www.spambrave.com/

2 2

NUBIE: extending pstricks output; printing subsystem
by Richard Henwood 20 Mar '07

20 Mar '07

Hi folks, I'm looking into fixing (text doesn't appear in output with latest SVN) and extending it to support embedding text as text. During a preliminary familiarisation hack, I've introduced a function: PrintLatex::text(Inkscape::Extension::Print *mod, char const *text, NR::Point p, SPStyle const *const style) (using ps.cpp as an example). I need the position of the text, and I was hoping that p[NR::X] and p[NR::Y] would give this, but they have the value 0.0000 0.0000 I'm new to cpp and Inkscape. Can you advise where I might be going wrong - and any wiki documents I should be checking in addition to PrintingSubsystem best regards, richard

2 1

Contributing...
by Jeff Schiller 20 Mar '07

20 Mar '07

I've become interested in Inkscape again and I'd like to figure out a good way to contribute. Here's a couple things I thought I'd throw out there: 1) I'm used to Bugzilla, has there been any discussion about moving away from a Sourceforge Bug Tracker into something a little more powerful (in terms of search? 2) In Mozilla, anyone can submit a patch to a bug, then the admins/super-reviewers must accept and merge the patch. Is there a mechanism for this within Inkscape? For instance, I'd like to report a bug against a SVG tutorial and then post a suggested fix for it that an admin can take and merge into the codebase. Similarly, my ambitions would be to get into the source code of Inkscape eventually and attempt another patch (this is more of a long-term goal though). Basically is there a way for the "casual" developer to submit patches in a standardized way? Thanks, Jeff

3 4

Security updates to Inkscape
by Kees Cook 20 Mar '07

20 Mar '07

Just before 0.45.1 was going to release I happened to do an audit of Inkscape's use of printf-style format strings (and the "..." argument). Unfortunately, there were multiple vulnerabilities[1]. Aaron gracefully delayed the final release so I could get CVEs issued, and notify other distributions. The basic problem the use of a *printf call directly on a variable without a format string. For example: printf(variable); vs printf("%s",variable); In the former, printf will parse any format chars in "variable", including the dangerous "%n", which allows for arbitrary memory overwriting. When functions use "..." to take in format strings for later processing by a *printf function, you can end up in the same situation. (Sorry to pick on ishmal's code, but it's a good example.) From the recent security fix commit: - status(event.getData().c_str()); + status("%s", event.getData().c_str()); "status" was defined as: virtual void status(const char *fmt, ...); Now, since the code is *filled* with format string "..." usage, it can be a real pain to find them all. Luckily, gcc has an attribute to flag a function as acting like a printf-family call, and Glib has a macro to create this attribute if gcc is being used as the compiler. So, now "status" is defined as: virtual void status(const char *fmt, ...) G_GNUC_PRINTF(2,3); The two args in G_GNUC_PRINTF point[2] to the format string variable, and the "..." argument. In the case of a class (as above) there is an implicit "this" argument as argument #1, meaning the format string "fmt" is really arg 2, and the "..." happens at position 3, as reflected in the G_GNUC_PRINTF usage. These markings, combined with the gcc compiler flag "-Wformat-security" will issue warnings about missing format strings, and do other strict type-checking. I've added this to the default CFLAGS as well. (And -D_FORTIFY_SOURCE=2, which adds even more protections via glibc.) Overall, many format issues were corrected[3], only a few of which were security-sensitive (37 files changed, 120 insertions(+), 111 deletions(-)). When making new "..."-using function, please review the glib macros for appropriate attributes, and take care to use them safely. I'd especially appreciate it if someone could look at: ./display/sp-canvas.h:SPCanvasItem *sp_canvas_item_new(SPCanvasGroup *parent, GtkType type, const gchar *first_arg_name, ...); This seems to be a NULL-terminated list (and not a format string, obviously), but it should get marked as such[4] if that's true. The dom/js/ tree is stuffed with "..." and I did not audit it, since it is not hooked up yet. However, we need to be very careful with it, and I'd MUCH prefer this code stayed outside of the inkscape code base so we can just link to an external library in the event of security updates to those libraries. Let me know if anyone has any questions; I'd like to keep inkscape as safe as possible. :) Thanks, -Kees [1] Try it yourself: prior to current trunk and 0.45.1, run this: inkscape /tmp/no-such-file-%x.svg And you'll see the "%x" turned into a number off the edge of the stack. The Jabber protocol handler was also vulnerable. [2] http://developer.gnome.org/doc/API/2.0/glib/glib-Miscellaneous-Macros.html#… [3] http://inkscape.svn.sourceforge.net/viewvc/inkscape?view=rev&revision=14554 [4] http://developer.gnome.org/doc/API/2.0/glib/glib-Miscellaneous-Macros.html#… -- Kees Cook @outflux.net

1 0

Hi everyone!!
by Celina Jorge 20 Mar '07

20 Mar '07

I arrive just now in this mailing list. At first, I have to say that my mother language isn't english, but portuguese, so I ask you to apologize any grammar/spell error. Here, in Brazil, I'm very interested in Inkscape plugins development, although I'm still trying write the first and studying things like SVG and XML. You also can find me in Inkscape-Brasil mailing list. It's a pleasure to be here. [ ]'s -- +..........................................................+ . Gmail:celina.jorge@...400... . . JID: celj@...1696... . . Msn: celina_jorge@...864... . . . . http://celde.wordpress.com . . http://www.cin.ufpe.br/~cinlug/planet/ . +...........................................................+

2 2

Re: [Inkscape-devel] Summer of Code 2007 - Possible application?
by Gail Banaszkiewicz 20 Mar '07

20 Mar '07

Hey Max! You seem to share the same enthusiasm as I do. You have beat me to the bug fixing though... I was hoping to do that this week along with putting together some proposals ;) > On second thought, the shared interest of two people could also be a > great advantage because maybe there is a way to split the project into > smaller parts which can be tackled more or less independently. I think that if this is possible, it's a really great idea. Our abilities seem to match up well, because as you say, you have a (probably) deeper understanding of the math, and I (may) have more programming experience given that my major is computer science rather than minor. Yet I imagine we are both sufficiently proficient in both aspects. I guess we can wait and see what the good mentoring folks say, but if we can come up with complementary proposals where we each have separate and sufficient work, I imagine our chances are good! I should note, though, that there are many suggested projects I am interested in, which somewhat deters me from wanting to come up with my own ideas ;) Instead, I may just try to put together a killer proposal for the suggested project ideas. We'll see what happens. My point here is mostly that if you turn out to be more suited for the 3D tool, there are no hard feelings. We should both put forward multiple proposals if possible and it would be nice if we could both get in. Looking forward to seeing how this will play out, Gail

3 3

Inkscape and barcodes - Inkbar (fwd)
by Alan Horkan 19 Mar '07

19 Mar '07

I was going to send this to inkscape users to help inform them about the Inkbar Barcode extension and ask if anyone know who was the author of Inkbar. Instead I thought maybe it would be better to direct it here so that developers might share their thoughts on making extensions easier to develop since Inkbar does suffer some of the common problems? ---------- Forwarded message ---------- Date: Mon, 19 Mar 2007 22:50:05 +0000 (GMT) From: Alan Horkan <horkana@...44...> Subject: Inkscape and barcodes - Inkbar I was thinking a barcode program could make some of the work I'm doing at the moment a lot easier, especially one I could also run on windows (Kbarcode is a good barcode AND label program but it is not availalbe for windows). On a whim I searched google for Inkscape + Barcodes and turned up a nice page in the Wiki listing some extensions* which are not included by default (doesn't make sense to include all extensions* by default). http://inkscape.org/wiki/index.php/ExtensionsRepository In particular it looks like "InkBar" might do what I need http://www.inkbar.lineaire.net/ My french is a bit rusty and I cannot see any contact or author information either on that page or included with the extension but I would apprecaite some help and perhaps my concerns with this script* are applicatable to others. I've had similar concerns before when writing scripts for the GNU Image Manipulation Program (GIMP) and some Javascript bookmarklets so these suggestions are based on a fair measure of experience, and some of things I wished I'd had to help me write my scripts. First there is the problem of translation. I'm not sure how we can help translate third party extensions/plugins/scripts/whatever*. I would guess that perhaps certain strings would keep coming up over and over again such as Angles, Detail, Gradient, Path, or something like that so maybe Inkscape could provide some kind of stock labels which would get translated once then any script writer could reuse them (something like how Gnome stock lables are supposed to work)? The other problem - and I've seen this a million times with GIMP scripts - is input checking. The inkbar script fails if the required 12 or 13 characters are not provided, which isn't very forgiving. (In the case of inkbar the rest could probably be padded with spaces.) In general scripts will require input checking, and hopefully this isn't something each script developer would need to writer their own collection of checks and tests for (because in that case testing is unlikely to happen at all). In the case of Python scripts (and any other scripts) there is something of a delay between the time the user sets the values and then hits OK (lets call that stage 1) to execute the script and then another delay before the script runs (stage 2). In practice this delay is usually quite short but delay and errors could be avoided if there was some immediate error checking as the user types to make sure a letter is not typed into a box where only numbers are allowed even before the OK button is hit (stage 1). After the OK button has been hit other checks may also be necessary. (Sorry very tired, I'll stop and try and explain better later, but I think I should probably have phrased things for developers in terms of preprocessing and postprocessing like on Web based forms as an example of how much easier extensions might be.) Anyway, I could do with some help contacting the author of the Inkbar barcode extensions and I hope to get a lot of use out of it (and help make it easier to use, provide an English translation, and anything else i can think of). I do believe it could gain inkscape a lot of attention in small businesses and more. (Useful as Inkbar could be for me I'm not saying I'd want to include it by default, not yet anyway. Inkscape for artists.) Off to see if I can modify the script to group the output to keep things tidy and stop them from falling apart. Sincerely Alan Horkan http://advogato.org/person/AlanHorkan/ http://www.linkedin.com/in/alanhorkan http://alanhorkan.livejournal.com/ * cannot use the jargon consistently, brain hurts, long day P.S. Looking at the command line options I see they are also in French, hmm.

1 0