Georg Baum wrote:
(Talking about the $$p parameter that could be passed to a converter)

>> I checked the code in 140cvs and it looks as if this parameter does
>> not get used (any more?).
> 
> Indeed. I don't know why.

Because it is a huge security hole if we don't protect individual arguments
with quotes. Consider $$p as `rm -rf $HOME/*`. Remember that the value for
$$p is stored in the LyX file, so we *have* to ensure it is safe if we are
to avoid .lyx-file-as-virus problems.

> Maybe. Maybe it is also a good idea to use $$p for converters, but we
> need to know why the converter needs that flag in order to decide that.

-- 
Angus

Reply via email to