diff options
| author | Pav Lucistnik <pav@FreeBSD.org> | 2005-06-04 00:56:01 +0000 |
|---|---|---|
| committer | Pav Lucistnik <pav@FreeBSD.org> | 2005-06-04 00:56:01 +0000 |
| commit | 14464c0044da885069cb679df8801610d3433f0f (patch) | |
| tree | 8a2e09cd9ad465a172f09ff76d23c527b45f56b2 /mail/mailman/files/patch-Mailman::Cgi::private.py | |
| parent | - Don't fail make clean when expected files are not present (diff) | |
- Update to 2.1.6
PR: ports/81814
Submitted by: Vivek Khera <vivek@khera.org> (maintainer)
Notes
Notes:
svn path=/head/; revision=136776
Diffstat (limited to 'mail/mailman/files/patch-Mailman::Cgi::private.py')
| -rw-r--r-- | mail/mailman/files/patch-Mailman::Cgi::private.py | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/mail/mailman/files/patch-Mailman::Cgi::private.py b/mail/mailman/files/patch-Mailman::Cgi::private.py deleted file mode 100644 index 08fd1390c7a6..000000000000 --- a/mail/mailman/files/patch-Mailman::Cgi::private.py +++ /dev/null @@ -1,34 +0,0 @@ -Index: Mailman/Cgi/private.py -=================================================================== -RCS file: /cvsroot/mailman/mailman/Mailman/Cgi/private.py,v -retrieving revision 2.16.2.1 -diff -u -r2.16.2.1 private.py ---- private.py 8 Feb 2003 07:13:50 -0000 2.16.2.1 -+++ private.py 10 Feb 2005 03:34:21 -0000 -@@ -1,4 +1,4 @@ --# Copyright (C) 1998-2003 by the Free Software Foundation, Inc. -+# Copyright (C) 1998-2005 by the Free Software Foundation, Inc. - # - # This program is free software; you can redistribute it and/or - # modify it under the terms of the GNU General Public License -@@ -35,13 +35,17 @@ - _ = i18n._ - i18n.set_language(mm_cfg.DEFAULT_SERVER_LANGUAGE) - -+SLASH = '/' -+ - - - def true_path(path): - "Ensure that the path is safe by removing .." -- path = path.replace('../', '') -- path = path.replace('./', '') -- return path[1:] -+ parts = path.split(SLASH) -+ safe = [x for x in parts if x not in ('.', '..')] -+ if parts <> safe: -+ syslog('mischief', 'Directory traversal attack thwarted') -+ return SLASH.join(safe)[1:] - - - |