Index: head/www/twiki/files/patch-cve-2014-7236 =================================================================== --- head/www/twiki/files/patch-cve-2014-7236 (revision 401914) +++ head/www/twiki/files/patch-cve-2014-7236 (nonexistent) @@ -1,17 +0,0 @@ -Obtained-from: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236 ---- lib/TWiki/Plugins.pm.save1 2014-01-09 02:10:56.000000000 -0500 -+++ lib/TWiki/Plugins.pm 2014-10-01 20:30:36.000000000 -0400 -@@ -186,8 +186,11 @@ - - unless( $allDisabled ) { - if ( $query && defined( $query->param( 'debugenableplugins' ))) { -- @pluginList = split( /[,\s]+/, -- $query->param( 'debugenableplugins' )); -+ @pluginList = -+ grep { /Plugin$/ } -+ map { s/[^a-zA-Z0-9]//go; $_ } # Item7558: Sanitize parameter -+ split( /[,\s]+/, $query->param( 'debugenableplugins' )); -+ - } else { - if( $TWiki::cfg{PluginsOrder} ) { - foreach my $plugin( split( /[,\s]+/, Property changes on: head/www/twiki/files/patch-cve-2014-7236 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property