web commit by http://id.inelegant.org/

[ikiwiki.git] / doc / patchqueue / lib-fixup.mdwn

diff --git a/doc/patchqueue/lib-fixup.mdwn b/doc/patchqueue/lib-fixup.mdwn
index 3d509fe8a95010eedc97fa687436f021e1a8c614..c8c14518938f038e2ee1cc6f1e50b96c4430769d 100644 (file)
--- a/doc/patchqueue/lib-fixup.mdwn
+++ b/doc/patchqueue/lib-fixup.mdwn
@@ -2,35 +2,51 @@ I'm using Ikiwiki on a box where I don't have root access, so I install all of m
 
 I imagine that there's a clean and elegant solution to this, but the hack I'm currently using is to have `./make` alter `ikiwki.in` before it's run, by inserting `use lib ...` lines for each of the directories in `$ENV{PERL5LIB}`. Again, this is clearly ugly, but it allows me to run `./make`, so I'm submitting it FWIW.
 
+> I don't like this patch because it's not expected that an environment
+> variable will stick around outside the shell that it's set in. It could
+> lead to suprising behavior if PERL5LIB happened to be set during build,
+> and it's even possible for it to lead to security issues, imagine if I
+> accidentially built the debian package of ikiwiki with PERL5LIB set --
+> then it would be hardcoded to look in /home/joey for libraries, which
+> someone with a "joey" account elsewhere could use to exploit it.
+>
+> You could remove the taint switch locally, it's very unlikely to find
+> tainting problems that nobody else has noticed. --[[Joey]]
+
+>> I completely understand rejecting this patch, but would you accept one to automate the removal of -T as a `make` option, then? I was trying to install Ikiwiki on a very popular
+>> web host, and the aforementioned issue took quite a while to debug; I imagine many people would have simply given up. -- Ben
+
 <pre> 
+Index: Makefile.PL
+===================================================================
+--- Makefile.PL (revision 2630)
++++ Makefile.PL (working copy)
+@@ -24,6 +24,7 @@
+ )
+ 
+ extra_build:
++       LANG=C ./lib-fixup.pl ikiwiki.in
+        LANG=C ./ikiwiki.in doc html --templatedir=templates \
+                --underlaydir=basewiki \
+                --wikiname="ikiwiki" --verbose --no-rcs \
 Index: lib-fixup.pl
 ===================================================================
 --- lib-fixup.pl        (revision 0)
 +++ lib-fixup.pl        (revision 0)
-@@ -0,0 +1,7 @@
+@@ -0,0 +1,9 @@
 +#!/usr/bin/perl -i.bak -p
 +use strict;
 +use warnings;
-+my $libs = join('', map { "use lib '$_';\n" } split /:/, $ENV{PERL5LIB});
-+s/(use IkiWiki;)/$1\n$libs/;
-+
-+
++my @dirs = $ENV{PERL5LIB} =~ /:/ ? split /:/, $ENV{PERL5LIB} : $ENV{PERL5LIB};
++if (@dirs) {
++    my $libs = join('', map { " use lib '$_';\n" } @dirs);
++    s/(use IkiWiki;)/$libs$1/;
++}
++ 
 
 Property changes on: lib-fixup.pl
 ___________________________________________________________________
 Name: svn:executable
    + *
-Index: Makefile.PL
-===================================================================
---- Makefile.PL (revision 2628)
-+++ Makefile.PL (working copy)
-@@ -24,6 +24,7 @@
- )
- 
- extra_build:
-+       LANG=C ./lib-fixup.pl ikiwiki.in
-        LANG=C ./ikiwiki.in doc html --templatedir=templates \
-                --underlaydir=basewiki \
-                --wikiname="ikiwiki" --verbose --no-rcs \
 
-</pre>
\ No newline at end of file
+</pre>