From 14464c0044da885069cb679df8801610d3433f0f Mon Sep 17 00:00:00 2001 From: Pav Lucistnik Date: Sat, 4 Jun 2005 00:56:01 +0000 Subject: - Update to 2.1.6 PR: ports/81814 Submitted by: Vivek Khera (maintainer) --- mail/mailman/files/patch-Mailman::Cgi::private.py | 34 ----------------------- 1 file changed, 34 deletions(-) delete mode 100644 mail/mailman/files/patch-Mailman::Cgi::private.py (limited to 'mail/mailman/files/patch-Mailman::Cgi::private.py') diff --git a/mail/mailman/files/patch-Mailman::Cgi::private.py b/mail/mailman/files/patch-Mailman::Cgi::private.py deleted file mode 100644 index 08fd1390c7a6..000000000000 --- a/mail/mailman/files/patch-Mailman::Cgi::private.py +++ /dev/null @@ -1,34 +0,0 @@ -Index: Mailman/Cgi/private.py -=================================================================== -RCS file: /cvsroot/mailman/mailman/Mailman/Cgi/private.py,v -retrieving revision 2.16.2.1 -diff -u -r2.16.2.1 private.py ---- private.py 8 Feb 2003 07:13:50 -0000 2.16.2.1 -+++ private.py 10 Feb 2005 03:34:21 -0000 -@@ -1,4 +1,4 @@ --# Copyright (C) 1998-2003 by the Free Software Foundation, Inc. -+# Copyright (C) 1998-2005 by the Free Software Foundation, Inc. - # - # This program is free software; you can redistribute it and/or - # modify it under the terms of the GNU General Public License -@@ -35,13 +35,17 @@ - _ = i18n._ - i18n.set_language(mm_cfg.DEFAULT_SERVER_LANGUAGE) - -+SLASH = '/' -+ - - - def true_path(path): - "Ensure that the path is safe by removing .." -- path = path.replace('../', '') -- path = path.replace('./', '') -- return path[1:] -+ parts = path.split(SLASH) -+ safe = [x for x in parts if x not in ('.', '..')] -+ if parts <> safe: -+ syslog('mischief', 'Directory traversal attack thwarted') -+ return SLASH.join(safe)[1:] - - - -- cgit v1.2.3