X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/5fe490c7d7ead8a3c0cf06eeb4363f26ce4874c2..5bfdc886e6aef5776a4093d4c957320f55021a4a:/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn diff --git a/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn b/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn index 201d7fbec..c3beb8219 100644 --- a/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn +++ b/doc/bugs/Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn @@ -53,7 +53,7 @@ I didn't apply your following old patch against `Ikiwiki.pm` file: + } + + return eval $newpagespec; - } #}}} + } package IkiWiki::PageSpec; @@ -83,11 +83,16 @@ to break the code I distribute in my backport ;) + my $ret=eval possibly_foolish_untaint(pagespec_translate($spec)); return IkiWiki::FailReason->new("syntax error") if $@; return $ret; - } #}}} + } >> Thanks a lot, Joey! It works :) >> >> BTW, I was quite sure that you sent me the old patch via e-mail long time ago. >> Maybe I found it at old ikiwiki home page? I don't remember it now. >> ->> --[[Paweł|ptecza]] \ No newline at end of file +>> --[[Paweł|ptecza]] + +---- + +I'm marking this [[done]] since it only affects sarge. Sarge users should +use the patch above. --[[Joey]]