[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Fwd: Infobot bug.]


This will be fixed in the forthcoming update.

kevin

I would of posted this to the mailing list but the majordomo won't send me an
auth code.
Using 0.44.3 with the fortran maths enabled opens a security bug in that the
output is sent to the shell so it is possible to get the output of a simple
command (spaces are stripped), for example:
<werdfs> urlbot calc |id|cat|
<urlbot> uid=500(dgl) gid=500(dgl) groups=500(dgl)
<werdfs> urlbot calc |hostname|cat|
<urlbot> titan.dgl.cx

Here is the patch for Math.pl
43c43
<           open(P, "echo '$parm'|bc 2>&1 |");
---
>           open(P, "echo $parm|bc 2>&1 |");

-- 
-=[ David Leadbeater ]-=-[ dgl@dgl.cx ]-=-[ http://dgl.cx/ ]=-