Re: [Bug-wget] Wget tests

2016-08-15 Thread Tim Rühsen
On Montag, 15. August 2016 15:06:52 CEST Dale R. Worley wrote: > Can someone give me a hint how the wget tests work? The test > directories seem to contain no high-level documentation. As far as I > can tell, the pairs of files *.{trs,log} either are or correspond to the > various tests, but I

[Bug-wget] problems with some wget versions for LDAP authentication

2016-08-15 Thread Irina Gerasimov
Hello, we use an LDAP authentication scheme on our servers at GES DISC NASA GSFC to authenticate data access. We discovered that some wget versions do not correctly pass credentials to the LDAP server. To our knowledge wget 1.12 and lower as well as wget 1.17 do not work as expected and wget

Re: [Bug-wget] Wget tests

2016-08-15 Thread Matthew White
On Mon, 15 Aug 2016 15:06:52 -0400 wor...@alum.mit.edu (Dale R. Worley) wrote: > Can someone give me a hint how the wget tests work? The test > directories seem to contain no high-level documentation. As far as I > can tell, the pairs of files *.{trs,log} either are or correspond to the >

[Bug-wget] Wget tests

2016-08-15 Thread Dale R. Worley
Can someone give me a hint how the wget tests work? The test directories seem to contain no high-level documentation. As far as I can tell, the pairs of files *.{trs,log} either are or correspond to the various tests, but I can't find the file(s) that specify what the test invocations of wget

Re: [Bug-wget] Wget - acess list bypass / race condition PoC

2016-08-15 Thread Tim Rühsen
On Montag, 15. August 2016 10:02:55 CEST moparisthebest wrote: > Hello, > > I find it extremely hard to call this a wget vulnerability when SO many > other things are wrong with that 'vulnerable code' implementation it > isn't even funny: > > 1. The image_importer.php script takes a single

Re: [Bug-wget] Wget - acess list bypass / race condition PoC

2016-08-15 Thread moparisthebest
Hello, I find it extremely hard to call this a wget vulnerability when SO many other things are wrong with that 'vulnerable code' implementation it isn't even funny: 1. The image_importer.php script takes a single argument, why would it download with the recursive switch turned on? Isn't that