[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#129104: bug 129104 (buffer overflow + template reading in cgiemail)

On Thu, Jan 17, 2002 at 04:42:42PM +0000, Colin Watson wrote:
> On Wed, Jan 16, 2002 at 04:17:25PM -0500, Thomas Smith wrote:
> > Hmm, one problem that just occurred to me is that we can't easily make
> > the location of the template files a compile-time option because people
> > reconfigure their webservers to have different document roots, and the
> > current design of cgiemail requires the template files to have
> > PATH_TRANSLATEDs.  That means, I guess, that configuration file parsing
> > might have to be added.
> Yes, with the current design there really isn't any way to do it well
> (including backwards compatibility), only patch it up. I suggest a
> simple 'templatedir="/foo/bar/baz"' in a trusted place like
> /etc/cgiemail.conf. That has the advantage that it can be parsed by the
> shell, so you can easily set it with debconf and not clobber the old
> setting on upgrades.

Ok, that sounds as good as anything can be.  Go ahead and write the code
(or does there need to be more planning?); I'll do the debconf stuff +
make up a sane default template telling people what to do when cgiemail
stops working.  Templates should live in /usr/share/cgiemail, right?
'Cause they're architecture-independent.

Don't forget not to let people do something like "GET
/cgi-bin/cgiemail/../../../etc/passwd" :-)

> Colin Watson                                  [cjwatson@flatline.org.uk]

Thomas "resc" Smith <tgs@finbar.dyndns.org>
web: http://finbar.dyndns.org/
gpg key id 1024D/ACABA81E, fingerprint:
3A47 CFA5 0E5D CF4A 5B22  12D3 FF1B 84FE ACAB A81E

Attachment: pgpIi2b5uRPuS.pgp
Description: PGP signature

Reply to: