[PATCH] dvipdf doesnot pass -R flag to dvips

[michaelrsweet]

Version: 8.15.3
CUPS.org User: pieleric

Hello,

dvipdf doesnot pass any flag to dvips (they are all passed to gs). However, for some documents I really need to disable the (default) secure option of dvips, aka "-R0". For instnace, some documents which I need compile use figures from directories like "../fig", with the latest dvips it's forbiden by default, so I get this kind of error:
$ dvipdf Distribute-Polyedre.dvi
dvips: Could not find figure file ../fig/GaspardY.eps; continuing
dvips: Could not find figure file ../fig/multiArchi.eps; continuing
dvips: Could not find figure file ../fig/multiplicationMatrice.eps; continuing
dvips: Could not find figure file ../fig/multiplicationMatrice.eps; continuing

In such case it's necessary to be able to pass -R flag to dvips. gs doesn't have -R option so there is no problem. Attached is a patch to dvipdf which allows passing the secure option to dvips.

[michaelrsweet]

CUPS.org User: htl10

Security not be by-passed at the system level for user-convenience.

On a per-user set-up, you can achieve the same effect without
sacrifying security, by creating some symbolic links like this:

ln -s ../fig/GaspardY.eps
../fig/multiArchi.eps
../fig/multiplicationMatrice.eps
../fig/multiplicationMatrice.eps .

and modify your latex file to read from current directory instead of
one directory above.
(and I think there is at least another non-security-breaking solution,
by teaching dvips to search alternative locations for file - in general,
hard-coding paths in latex files aren't really a good practice).

[michaelrsweet]

CUPS.org User: pieleric

Yes, I agree with you, probably the correct way is to create symlinks and modify the latex documents. (in my case it's just a bit more complex because there are hundreds of documents written by different people which suddently don't compile anymore ;-) )

Still, I do beleive that if dvips has a "-R0" option, dvipdf should also be able to support the same option. From a user point of view, dvipdf is exactly like dvips but generates PDF files instead of PS files. It's very strange that some DVI files can be compiled with dvips (using -R0) while cannot be compiled with dvipdf at all. If the user knows that he can trust the DVI, then there is no need of forcing the security options.

[michaelrsweet]

CUPS.org User: htl10

There are two other ways of achieving what you want: dvips options
can be specified in $HOME/.dvipsrc on a per-user basis, or as a
site-wide modification by modifying ${TEXMF}/dvips/config/config.ps .
Also, you can create a modified version of dvipdf in your /usr/local
or other location which is site-specific to your installation in everybody's $PATH.

I just really do not see why a change that you want at the sacrifice
of security, either for your personal need or your site's need,
should be made to everybody's cups installation world-wide.

Can you explain why this change is a good idea for every cups user worldwide?

[michaelrsweet]

CUPS.org User: pieleric

In this patch I'm not proposing to reduce security: by default the behaviour of dvipdf is unchanged.

What I propose is to extend the "security model" to the same one as dvips, that is: if the user trusts the document, then he might be able to reduce the security (= have the same behaviour as older versions) by explicitely adding the flag "-R0".

This allows backward compatibility while keeping the new security model by default. At least, this is the dvips behavior, if you do not beleive it is secure enough, I'd suggest to modify dvips accordingly :-)

[michaelrsweet]

CUPS.org User: mike

Fixed in Subversion repository.

[michaelrsweet]

"dvipdf-pass-secure-option.patch":

--- /usr/bin/dvipdf.bak 2006-10-15 11:38:25.000000000 +0200
+++ /usr/bin/dvipdf 2006-10-15 11:42:06.000000000 +0200
@@ -8,9 +8,11 @@

Based on ps2pdf

OPTIONS=""
+DVIPSOPTIONS=""
while true
do
case "$1" in

• -R_) DVIPSOPTIONS="$DVIPSOPTIONS $1";;
  -_) OPTIONS="$OPTIONS $1" ;;
  *) break ;;
  esac
  @@ -37,4 +39,4 @@

We have to include the options twice because -I only takes effect if it

appears before other options.

-exec dvips -q -f "$infile" | gs $OPTIONS -q -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
+exec dvips $DVIPSOPTIONS -q -f "$infile" | gs $OPTIONS -q -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -