can be used to avoid a security check that is a good safe default, but
problimatic overkill in some situations.
I decided to underdocument this, because the option looks ugly, and I don't
want people randomly turning it on because it looks like a good idea. So if
you need it, you'll get an error message mentioning how to fix it.
} #}}}
sub refresh () { #{{{
- # security check, avoid following symlinks in the srcdir path
+ # security check, avoid following symlinks in the srcdir path by default
my $test=$config{srcdir};
while (length $test) {
- if (-l $test) {
- error("symlink found in srcdir path ($test)");
+ if (-l $test && ! $config{allow_symlinks_before_srcdir}) {
+ error("symlink found in srcdir path ($test) -- set allow_symlinks_before_srcdir to allow this");
}
unless ($test=~s/\/+$//) {
$test=dirname($test);
* Really fix bug with links to pages with names containing colons.
Previous fix mised a few cases.
* Avoid troublesome abs_path calls in wrapper setup.
+ * Add allow_symlinks_before_srcdir config setting that can be used to avoid
+ a security check that is a good safe default, but problimatic overkill in
+ some situations.
-- Joey Hess <joeyh@debian.org> Mon, 21 Jul 2008 11:35:46 -0400
> the `srcdir`.
> --[[Joey]]
+>> Slightly modified version of patch applied. --[[Joey]]
+
>> Ok, I'll try to get it cleaned up and documented.
There is a second location where this can be an issue. That is in the
>>> Patch using rel2abs() works well - it no longer expands symlinks.
>>>> That patch is applied now. --[[Joey]]
+
+[[tag done]]