Control: severity -1 grave On 25.03.2015 18:24, Felix Geyer wrote: > On 23.03.2015 23:15, Felix Geyer wrote: >> It looks like upstream attempted to fix / work around the issue. >> >> From the WinRAR Version 5.21 changelog: >> >>> 4. Now by default WinRAR skips symbolic links with absolute paths >>> in link target when extracting. You can enable creating such links >>> with "Allow absolute paths in symbolic links" option on "Advanced" >>> page of extraction dialog or with -ola command line switch. >>> >>> Such links pointing to folders outside of extraction destination >>> folder can present a security risk. Enable their extraction only >>> if you are sure that archive contents is safe, such as your own >>> backup. >> >> The -ola switch and related changes are part of 5.2.5 but I can still >> reproduce >> the problem with this version. > > I've notified upstream about the incomplete fix. > Attached are patches for 5.0.10 and 5.2.5. > Review would be appreciated.
Upstream published version 5.2.7 which contains the complete fix. Cheers, Felix -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
