On 2017-04-11 10:02, Mark Janssen wrote:
That's not a security hole at all. Once a file was added, ignoring it will not remove past version from the repository. History in fossil is immutable. If you inadvertently added a file which shouldn't be there you should shun it instead.
It is very well a security issue if I place a password in a file at a later point in time and use --ignore to not include it anymore but that command is silently dropped.
My intuition tells me that the old version without password is in the repository while the new version containing a password is not.
That's got nothing to do with immutable. It's just what I told it to do. Ignore the file from now on.
https://www.fossil-scm.org/xfer/help/addremove https://www.fossil-scm.org/xfer/help/add "If files are attempted to be added explicitly on the command line which match "ignore-glob", a confirmation is asked first. This can be prevented using the -f|--force option." That's not the case for addremove. _______________________________________________ fossil-users mailing list fossil-users@lists.fossil-scm.org http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
