diff --git a/_config.yml b/_config.yml
index 7725077b..5ba8eb0b 100644
--- a/_config.yml
+++ b/_config.yml
@@ -48,6 +48,7 @@ collections:
feed:
categories:
- general
+ - security
show_excerpts: true # set to true to show excerpts on posts
@@ -102,6 +103,12 @@ defaults:
values:
category: packages
+ -
+ scope:
+ path: "_posts/*/security"
+ values:
+ category: security
+
# Set page.lang for all posts files under respective languages and permalink with /en/:collection prefix
-
diff --git a/_data/posts/t/cn/views.yml b/_data/posts/t/cn/views.yml
index a048ccaf..01e37899 100644
--- a/_data/posts/t/cn/views.yml
+++ b/_data/posts/t/cn/views.yml
@@ -3,7 +3,9 @@ index:
apps: 应用
general: 常规
packages: 包
+ security: 安全
apps_posts: 关于应用的文章
general_posts: 常规文章
packages_posts: 关于软件包的文章
+ security_posts: 安全类文章
subscribe_to_rss_feed: 订阅RSS源
diff --git a/_data/posts/t/en/views.yml b/_data/posts/t/en/views.yml
index 4ed5c09c..61170286 100644
--- a/_data/posts/t/en/views.yml
+++ b/_data/posts/t/en/views.yml
@@ -3,7 +3,9 @@ index:
apps: Apps
general: General
packages: Packages
+ security: Security
apps_posts: Apps Posts
general_posts: General Posts
packages_posts: Packages Posts
+ security_posts: Security Posts
subscribe_to_rss_feed: Subscribe to RSS feed
diff --git a/_data/sitemap.yml b/_data/sitemap.yml
index 493793ba..a5be1945 100644
--- a/_data/sitemap.yml
+++ b/_data/sitemap.yml
@@ -2,4 +2,6 @@ excludes:
- /redirects.json
- /feed.xml
- /general/2022/02/15/termux-apps-vulnerability-disclosures.html
+ - /en/posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html
+ - /cn/posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html
- /apps/2022/02/25/termux-tasker-v0.6.0-release.html
diff --git a/_data/t/cn/views/navigation.yml b/_data/t/cn/views/navigation.yml
index f7d14b04..d01164b1 100644
--- a/_data/t/cn/views/navigation.yml
+++ b/_data/t/cn/views/navigation.yml
@@ -4,6 +4,7 @@ docs: 文档
posts: 文章
packages: 软件包
donate: 捐赠
+security: 安全
privacy_policy: 隐私政策
# Footer
diff --git a/_includes/header.html b/_includes/header.html
index c9a0e833..7735b63c 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -23,7 +23,7 @@
{%- if file_exists.size != 0 -%}
{%- include t.html key="views.navigation.docs" -%}
{%- else -%}
- {%- include t.html key="views.navigation.docs" lang=site.lang -%}
+ {%- include t.html key="views.navigation.docs" -%}
{%- endif -%}
{%- assign path = page.lang | append: "/posts/index.md" -%}
@@ -31,7 +31,7 @@
{%- if file_exists.size != 0 -%}
{%- include t.html key="views.navigation.posts" -%}
{%- else -%}
- {%- include t.html key="views.navigation.posts" lang=site.lang -%}
+ {%- include t.html key="views.navigation.posts" -%}
{%- endif -%}
{%- include t.html key="views.navigation.packages" -%}
@@ -41,7 +41,7 @@
{%- if file_exists.size != 0 -%}
{%- include t.html key="views.navigation.donate" -%}
{%- else -%}
- {%- include t.html key="views.navigation.donate" lang=site.lang -%}
+ {%- include t.html key="views.navigation.donate" -%}
{%- endif -%}
{%- assign path = page.lang | append: "/security.md" -%}
@@ -49,7 +49,7 @@
{%- if file_exists.size != 0 -%}
{%- include t.html key="views.navigation.security" -%}
{%- else -%}
- {%- include t.html key="views.navigation.security" lang=site.lang -%}
+ {%- include t.html key="views.navigation.security" -%}
{%- endif -%}
{%- assign path = page.lang | append: "/privacy-policy.md" -%}
@@ -57,7 +57,7 @@
{%- if file_exists.size != 0 -%}
{%- include t.html key="views.navigation.privacy_policy" -%}
{%- else -%}
- {%- include t.html key="views.navigation.privacy_policy" lang=site.lang -%}
+ {%- include t.html key="views.navigation.privacy_policy" -%}
{%- endif -%}
{%- if page.page_ref and page.lang -%}
diff --git a/_includes/posts/category.html b/_includes/posts/category.html
index a3e5a8e1..d7d01883 100644
--- a/_includes/posts/category.html
+++ b/_includes/posts/category.html
@@ -3,7 +3,7 @@
{%- assign category_posts = site.categories[page.category_name] | where: "lang", page.lang -%}
{%- assign category_translate_key = "views.index." | append: page.category_name | append: "_posts" -%}
-
{%- include t.html root="posts" key=category_translate_key -%} ({{- category_posts.size | default: "0" -}})
+ {%- include t.html root="posts" key=category_translate_key %} ({{- category_posts.size | default: "0" -}})
{%- if category_posts.size > 0 -%}
diff --git a/_layouts/posts/index.md b/_layouts/posts/index.md
index e5133f70..b120cdaa 100644
--- a/_layouts/posts/index.md
+++ b/_layouts/posts/index.md
@@ -7,6 +7,7 @@ layout: page
- [{%- include t.html root="posts" key="views.index.general" -%}](/{{- page.lang -}}/posts/general.html)
- [{%- include t.html root="posts" key="views.index.apps" -%}](/{{- page.lang -}}/posts/apps.html)
- [{%- include t.html root="posts" key="views.index.packages" -%}](/{{- page.lang -}}/posts/packages.html)
+- [{%- include t.html root="posts" key="views.index.security" -%}](/{{- page.lang -}}/posts/security.html)
[{%- include t.html root="posts" key="views.index.subscribe_to_rss_feed" -%}](/feed.xml).
diff --git a/_posts/cn/apps/2022-02-25-termux-tasker-v0.6.0-release.md b/_posts/cn/apps/2022-02-25-termux-tasker-v0.6.0-release.md
index cac6a310..176866f4 100644
--- a/_posts/cn/apps/2022-02-25-termux-tasker-v0.6.0-release.md
+++ b/_posts/cn/apps/2022-02-25-termux-tasker-v0.6.0-release.md
@@ -5,7 +5,7 @@ page_ref: /posts/apps/2022/02/25/termux-tasker-v0.6.0-release.html
`Termux:Tasker` `v0.6.0` 版本已经发布。
-**强烈建议您更新到 `v0.5.0` 或更高版本以修复 [Termux 应用程序漏洞披露](https://termux.github.io/general/2022/02/15/termux-apps-vulnerability-disclosures.html) 。**
+**强烈建议您更新到 `v0.5.0` 或更高版本以修复 [Termux 应用程序漏洞披露](https://termux.github.io/cn/posts/security/2022/02/15/termux-apps-vulnerability-disclosures.html) 。**
##
diff --git a/_posts/cn/general/2022-02-15-termux-apps-vulnerability-disclosures.md b/_posts/cn/security/2022-02-15-termux-apps-vulnerability-disclosures.md
similarity index 98%
rename from _posts/cn/general/2022-02-15-termux-apps-vulnerability-disclosures.md
rename to _posts/cn/security/2022-02-15-termux-apps-vulnerability-disclosures.md
index d5516ab8..fd50888b 100644
--- a/_posts/cn/general/2022-02-15-termux-apps-vulnerability-disclosures.md
+++ b/_posts/cn/security/2022-02-15-termux-apps-vulnerability-disclosures.md
@@ -1,6 +1,8 @@
---
title: "Termux应用程序漏洞披露"
-page_ref: /posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html
+redirect_from:
+ - /cn/posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html
+page_ref: /posts/security/2022/02/15/termux-apps-vulnerability-disclosures.html
---
这是 `termux-app`、`termux-tasker` 和 `termux-widget` 的漏洞报告。
@@ -86,11 +88,11 @@ context.sendBroadcast(intent);
或者从任何一个应用程序,执行以下 Java 代码:
```java
- Intent intent = new Intent();
- intent.setClassName("com.termux.widget", "com.termux.widget.TermuxLaunchShortcutActivity");
- intent.setData(Uri.parse("/sdcard/exploit.sh"));
- intent.putExtra("com.termux.shortcut.token", "22e30b81-5d67-4ee3-be0e-66169f637025");
- startActivity(intent);
+ Intent intent = new Intent();
+ intent.setClassName("com.termux.widget", "com.termux.widget.TermuxLaunchShortcutActivity");
+ intent.setData(Uri.parse("/sdcard/exploit.sh"));
+ intent.putExtra("com.termux.shortcut.token", "22e30b81-5d67-4ee3-be0e-66169f637025");
+ startActivity(intent);
```
Termux 应用程序将会执行使用 `/data/data/com.termux/files/usr/bin/sh` 执行 `/sdcard/exploit.sh` 脚本,`/sdcard` 被挂载为 `noexec` 也没有问题。
diff --git a/_posts/en/apps/2022-02-25-termux-tasker-v0.6.0-release.md b/_posts/en/apps/2022-02-25-termux-tasker-v0.6.0-release.md
index 6e8e1715..df51c28f 100644
--- a/_posts/en/apps/2022-02-25-termux-tasker-v0.6.0-release.md
+++ b/_posts/en/apps/2022-02-25-termux-tasker-v0.6.0-release.md
@@ -6,7 +6,7 @@ page_ref: /posts/apps/2022/02/25/termux-tasker-v0.6.0-release.html
The `Termux:Tasker` `v0.6.0` is out.
-**It is highly recommended that you update to `v0.5.0` or higher for fixes for vulnerabilities disclosed in the [Termux Apps Vulnerability Disclosures](https://termux.github.io/general/2022/02/15/termux-apps-vulnerability-disclosures.html) post.**
+**It is highly recommended that you update to `v0.5.0` or higher for fixes for vulnerabilities disclosed in the [Termux Apps Vulnerability Disclosures](https://termux.github.io/en/posts/security/2022/02/15/termux-apps-vulnerability-disclosures.html) post.**
##
diff --git a/_posts/en/general/2022-02-15-termux-apps-vulnerability-disclosures.md b/_posts/en/security/2022-02-15-termux-apps-vulnerability-disclosures.md
similarity index 97%
rename from _posts/en/general/2022-02-15-termux-apps-vulnerability-disclosures.md
rename to _posts/en/security/2022-02-15-termux-apps-vulnerability-disclosures.md
index e5b652ed..3509c70a 100644
--- a/_posts/en/general/2022-02-15-termux-apps-vulnerability-disclosures.md
+++ b/_posts/en/security/2022-02-15-termux-apps-vulnerability-disclosures.md
@@ -1,7 +1,9 @@
---
title: "Termux Apps Vulnerability Disclosures"
-redirect_from: /general/2022/02/15/termux-apps-vulnerability-disclosures.html
-page_ref: /posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html
+redirect_from:
+ - /general/2022/02/15/termux-apps-vulnerability-disclosures.html
+ - /en/posts/general/2022/02/15/termux-apps-vulnerability-disclosures.html
+page_ref: /posts/security/2022/02/15/termux-apps-vulnerability-disclosures.html
---
This is a vulnerability report for `termux-app`, `termux-tasker` and `termux-widget`.
@@ -88,11 +90,11 @@ The `Termux:Widget` "security" worked by [generating a token](https://github.com
Or use java from any app.
```java
- Intent intent = new Intent();
- intent.setClassName("com.termux.widget", "com.termux.widget.TermuxLaunchShortcutActivity");
- intent.setData(Uri.parse("/sdcard/exploit.sh"));
- intent.putExtra("com.termux.shortcut.token", "22e30b81-5d67-4ee3-be0e-66169f637025");
- startActivity(intent);
+ Intent intent = new Intent();
+ intent.setClassName("com.termux.widget", "com.termux.widget.TermuxLaunchShortcutActivity");
+ intent.setData(Uri.parse("/sdcard/exploit.sh"));
+ intent.putExtra("com.termux.shortcut.token", "22e30b81-5d67-4ee3-be0e-66169f637025");
+ startActivity(intent);
```
The termux app will run the `/sdcard/exploit.sh` script with `/data/data/com.termux/files/usr/bin/sh` and `/sdcard` being mounted as `noexec` would not be an issue.
diff --git a/assets/posts/globals/general/2022-02-15-termux-apps-vulnerability-disclosures/Termux_Tasker_Exploit.tsk.xml b/assets/posts/globals/general/2022-02-15-termux-apps-vulnerability-disclosures/Termux_Tasker_Exploit.tsk.xml
index ab17481e..ebfd5fcc 100644
--- a/assets/posts/globals/general/2022-02-15-termux-apps-vulnerability-disclosures/Termux_Tasker_Exploit.tsk.xml
+++ b/assets/posts/globals/general/2022-02-15-termux-apps-vulnerability-disclosures/Termux_Tasker_Exploit.tsk.xml
@@ -7,7 +7,7 @@
100
300
-