[Winmerge-svn] SF.net SVN: winmerge:[7618] trunk

[<chr...@us...>]

Revision: 7618
          http://sourceforge.net/p/winmerge/code/7618
Author:   christianlist
Date:     2013-03-31 22:28:55 +0000 (Sun, 31 Mar 2013)
Log Message:
-----------
[patches:#3030] Unquoted program path vulnerability in installer integration with subversion 

Modified Paths:
--------------
    trunk/Docs/Users/ChangeLog.txt
    trunk/Installer/InnoSetup/WinMerge.iss

Modified: trunk/Docs/Users/ChangeLog.txt
===================================================================
--- trunk/Docs/Users/ChangeLog.txt	2013-03-31 22:22:58 UTC (rev 7617)
+++ trunk/Docs/Users/ChangeLog.txt	2013-03-31 22:28:55 UTC (rev 7618)
@@ -23,6 +23,7 @@
   Bugfix: WinMerge contained a vulnerability in handling project files (#3185386)
     (http://www.zeroscience.mk/mk/vulnerabilities/ZSL-2011-4997.php)
   Bugfix: Shell extension uses unquoted program path (patches:#3023)
+  Bugfix: Unquoted program path vulnerability in installer integration with subversion (patches:#3030)
   Bugfix: Download link to the 7-zip plugin installer is broken (bugs:#2128)
   New translations: 
   - Basque (#3387142, patches:#3024)

Modified: trunk/Installer/InnoSetup/WinMerge.iss
===================================================================
--- trunk/Installer/InnoSetup/WinMerge.iss	2013-03-31 22:22:58 UTC (rev 7617)
+++ trunk/Installer/InnoSetup/WinMerge.iss	2013-03-31 22:28:55 UTC (rev 7618)
@@ -552,10 +552,10 @@
 Root: HKCU; SubKey: Software\TortoiseCVS\Prefs\External Merge2 Params; ValueType: string; ValueName: _; ValueData: """%mine"" ""%yours"""; Flags: uninsdeletevalue dontcreatekey; Tasks: TortoiseCVS
 
 ;Set WinMerge as TortoiseGit diff tool
-Root: HKCU; SubKey: Software\TortoiseGit; ValueType: string; ValueName: Diff; ValueData: {app}\{code:ExeName} -e -ub -dl %bname -dr %yname %base %mine; Flags: uninsdeletevalue; Tasks: TortoiseGit
+Root: HKCU; SubKey: Software\TortoiseGit; ValueType: string; ValueName: Diff; ValueData: """{app}\{code:ExeName}"" -e -u -dl %bname -dr %yname %base %mine"; Flags: uninsdeletevalue; Tasks: TortoiseGit
 
 ;Set WinMerge as TortoiseSVN diff tool
-Root: HKCU; SubKey: Software\TortoiseSVN; ValueType: string; ValueName: Diff; ValueData: {app}\{code:ExeName} -e -ub -dl %bname -dr %yname %base %mine; Flags: uninsdeletevalue; Tasks: TortoiseSVN
+Root: HKCU; SubKey: Software\TortoiseSVN; ValueType: string; ValueName: Diff; ValueData: """{app}\{code:ExeName}"" -e -u -dl %bname -dr %yname %base %mine"; Flags: uninsdeletevalue; Tasks: TortoiseSVN
 
 ;Whatever the user chooses at the [Select Setup Language] dialog should also determine what language WinMerge will start up in
 ;(unless the user already has a startup language specified)

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.