bug-cvs
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Proposal to Remove Commit/Update-Prog Functionality


From: David Sainty
Subject: Re: Proposal to Remove Commit/Update-Prog Functionality
Date: Fri, 17 Jan 2003 12:32:31 +1300

Fabulous!

I'm pretty sure that NetBSD disables these already in the in-tree cvs.

>>> Derek Robert Price <address@hidden> 17/01/2003 08:35:43 >>>
Hey all,

I don't hear much about anyone who uses this functionality and it is a 
fairly major security hole in CVS, effectively allowing any client with 
write access to execute arbitrary code on a CVS server, so I am 
proposing the functionality be removed.

Please note that  I am proposing that the Checkin-prog and Update-prog 
commands be removed from the CVS protocol.  This is different from the 
*info scripts that can be specified by the CVS administrator to run 
scripts at update and checkout.

Alternately, if there are major objections to this, the code could be 
#ifdef'd or options provided in the CVSROOT/config file to enable the 
functionality, but I'd prefer to disable it.

Derek

-- 
                *8^)

Email: address@hidden 

Get CVS support at <http://ximbiot.com>!
-- 
I will not call the principal "spud head".
I will not call the principal "spud head".
I will not call the principal "spud head"...

          - Bart Simpson on chalkboard, _The Simpsons_



---------------------------------------------------------------------
To unsubscribe, e-mail: address@hidden 
For additional commands, e-mail: address@hidden 






reply via email to

[Prev in Thread] Current Thread [Next in Thread]