Bug#234309: Bug#423441: -f option raises security concerns

2007-06-18 Thread Axel Beckert
Hi, On Sun, Jun 17, 2007 at 09:16:57AM -0600, Neale Pickett wrote: > If that's the case, couldn't you do soemthing like (my perl is old and > rusty so apologies for the pseudo-perl): > > while (@ARGV) { > if (/^-([a-z])=(.*)$/) { > # do a big switch on $1, setting variables to $2 > } > }

Bug#234309: Bug#423441: -f option raises security concerns

2007-06-18 Thread Neale Pickett
Guys, > $conffile = param('-f') unless $ENV{GATEWAY_INTERFACE}; I'm not really comfortable with this as a fix, since it still relies on a CGI debugging feature to process arguments. I've brought in the security team, which apparently should have been done a long time ago. I suspect they'll ei

Bug#423441: -f option raises security concerns

2007-06-17 Thread Neale Pickett
Nick Leverton <[EMAIL PROTECTED]> writes: > > Thanks for your opinion, it's appreciated. But, pulling in > > Getopt::Long would require yet another module which I would want to > > avoid, especially since it still isn't fully GNU Getopt compatible in > > that it insists on a space between a shor

Bug#234309: Bug#423441: -f option raises security concerns

2007-06-17 Thread Nick Leverton
On Fri, Jun 15, 2007 at 07:35:55PM +0200, Gerfried Fuchs wrote: > On Fri, Jun 15, 2007 at 09:44:00AM -0600, Neale Pickett wrote: > > I decided not to use blosxom at all, and I haven't used Perl since > > version 4, but it seems like it wouldn't be a ton of work to do both: > > support Getopt::Long

Bug#423441: -f option raises security concerns

2007-06-15 Thread Gerfried Fuchs
On Fri, Jun 15, 2007 at 09:44:00AM -0600, Neale Pickett wrote: > I decided not to use blosxom at all, and I haven't used Perl since > version 4, but it seems like it wouldn't be a ton of work to do both: > support Getopt::Long and look at $ENV. Then, nothing breaks for > anybody. Thanks for your

Bug#423441: -f option raises security concerns

2007-06-15 Thread Gerfried Fuchs
Hi! I've today discussed the problem with an upstream developer. Where Nick's suggestion to use Getopt::Long for enabling the -f switch we were thinking about addressing the problem in a different way: Getting rid of the -f switch at all and instead use $ENV{BLOSXOM_CONFIG_FILE}. This