Lock.PM insecure with -T switch

[Martin Hepworth]

Or indeed if people are willing to get their hands in their pockets and
sponsor Julian to do this or buy him something nice from his Amazon list he
may have a little more incentive to do this.
(Assuming he's not playing with his new pet zend.to :-)

-- 
Martin Hepworth
Oxford, UK


On 21 June 2011 20:08, Peter Bonivart <bonivart at opencsw.org> wrote:

> On Tue, Jun 21, 2011 at 8:42 PM, Stuart Henderson <stu at spacehopper.org>
> wrote:
> > "really" untainting would be something more than the
> >
> > $foo =~ /^(.*)$/;
> > $foo = $1;
> >
> > and similar you see everywhere... running with -U or su'ing
> > to the "Run as user" before starting MailScanner isn't really any
> > worse than this.
>
> I agree with you and I don't suggest that the people who have trouble
> with this should fix this for Julian but if others are capable of
> writing, e.g., advanced custom functions and debugging Postfix support
> I think they are capable of properly untainting at least some of the
> code. It was just an open invitation without targeting anyone
> specific.
>
> It comes to a point when you answer the same question x amount of
> times you realize that if you fixed the source of the problem instead
> you would have saved time. :)
>
> /peter
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110622/7828bdc3/attachment.html