Bug#423441: Bug#234309: Bug#423441: -f option raises security concerns

2007-06-18 Thread Axel Beckert
Hi, On Sun, Jun 17, 2007 at 09:16:57AM -0600, Neale Pickett wrote: If that's the case, couldn't you do soemthing like (my perl is old and rusty so apologies for the pseudo-perl): while (@ARGV) { if (/^-([a-z])=(.*)$/) { # do a big switch on $1, setting variables to $2 } } and

Bug#423441: Bug#234309: Bug#423441: -f option raises security concerns

2007-06-18 Thread Neale Pickett
Guys, $conffile = param('-f') unless $ENV{GATEWAY_INTERFACE}; I'm not really comfortable with this as a fix, since it still relies on a CGI debugging feature to process arguments. I've brought in the security team, which apparently should have been done a long time ago. I suspect they'll