security hole in X????

[Carlos Carvalho <carlos@riglos.fisica.ufpr.br>]

Suppose you have a window open in the local machine and you telnet to
another one from that window. I discovered that telnet passes the
DISPLAY variable to the remote machine, while rlogin doesn't. Up to
now fine, except possibly for a bug in rlogin that doesn't pass the
env var.

The problem is that, with telnet, windows started on the remote
machine open without problems in the local display, even without
giving a xhost <remote> on the local machine. Is this correct? It only
happens if you are the same user on both machines.

Carlos