X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/02fd4b9f337dc8d88c47c13be7591f6e4b8949de..baee2aa36b987ec6f75738570fa3f46030484f76:/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn diff --git a/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn b/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn index e15522a88..c3beb8219 100644 --- a/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn +++ b/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn @@ -15,7 +15,7 @@ Temporarily I've disabled conditional plugin to avoid that bug. PS. I still use ikiwiki 1.50 backported for Debian 'sarge'. ---Pawel +--[[Paweł|ptecza]] --- @@ -53,7 +53,7 @@ I didn't apply your following old patch against `Ikiwiki.pm` file: + } + + return eval $newpagespec; - } #}}} + } package IkiWiki::PageSpec; @@ -67,7 +67,7 @@ because `patch` command fails: Could you please fix that patch? I guess how to do it, but I don't want to break the code I distribute in my backport ;) ---Pawel +--[[Paweł|ptecza]] > It's not my patch.. IIRC my suggestion was simply to do this: --[Joey]] @@ -83,11 +83,16 @@ to break the code I distribute in my backport ;) + my $ret=eval possibly_foolish_untaint(pagespec_translate($spec)); return IkiWiki::FailReason->new("syntax error") if $@; return $ret; - } #}}} + } >> Thanks a lot, Joey! It works :) >> >> BTW, I was quite sure that you sent me the old patch via e-mail long time ago. >> Maybe I found it at old ikiwiki home page? I don't remember it now. >> ->> --Pawel \ No newline at end of file +>> --[[Paweł|ptecza]] + +---- + +I'm marking this [[done]] since it only affects sarge. Sarge users should +use the patch above. --[[Joey]]