htdig-dev

[htdig-dev] HEADS UP: php wrapper script - potential exploit patched

[Dan L. <da...@la...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have just committed a fix to the php-wrapper.  This may or may not
have been a potential exploit.  The fix prevents people from including
arbitrary HTML or PHP code in their search string.  The fix
strips such tags from the input string.

To test the exploit, try entering an IMG html tag into your
search field, such as <img src=http://www.htdig.org/htdig_big.gif>.

If you see:

 There were no matches for [IMAGE] found on the website.

where [IMAGE] is the htDig image, then you have not patched
your system.
- -- 
Dan Langille
The FreeBSD Diary - http://freebsddiary.org/ - practical examples


-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8 -- QDPGP 2.61c
Comment: http://community.wow.net/grt/qdpgp.html

iQA/AwUBO8cv+QoLFxTP+508EQLRdQCg4+FE7xo/NxM+TpvS/0gyT9LYYTYAoOCM
bV1/W/eESdonK1V4rIfoebth
=m89W
-----END PGP SIGNATURE-----

Re: [htdig-dev] HEADS UP: php wrapper script - potential exploit patched

[Gilles D. <gr...@sc...>]

According to Dan Langille:
> I have just committed a fix to the php-wrapper.  This may or may not
> have been a potential exploit.  The fix prevents people from including
> arbitrary HTML or PHP code in their search string.  The fix
> strips such tags from the input string.

OK, but I thought I should point out that you're still committing to
the main branch of the htdig source tree, which hasn't seen any activity
since Feb 2000.  If you want your wrapper to be included in the 3.2.0b4
development, you have to check out the "htdig-3-2-x" branch of the tree
and commit your changes to that.

At some point, Geoff is going to fold this branch back into the main
branch, but this hasn't happened yet.

-- 
Gilles R. Detillieux              E-mail: <gr...@sc...>
Spinal Cord Research Centre       WWW:    http://www.scrc.umanitoba.ca/~grdetil
Dept. Physiology, U. of Manitoba  Phone:  (204)789-3766
Winnipeg, MB  R3E 3J7  (Canada)   Fax:    (204)789-3930

Re: [htdig-dev] HEADS UP: php wrapper script - potential exploit patched

[Dan L. <da...@la...>]

On 12 Oct 2001 at 14:53, Gilles Detillieux wrote:

> According to Dan Langille:
> > I have just committed a fix to the php-wrapper.  This may or may not
> > have been a potential exploit.  The fix prevents people from including
> > arbitrary HTML or PHP code in their search string.  The fix
> > strips such tags from the input string.
> 
> OK, but I thought I should point out that you're still committing to
> the main branch of the htdig source tree, which hasn't seen any activity
> since Feb 2000.  If you want your wrapper to be included in the 3.2.0b4
> development, you have to check out the "htdig-3-2-x" branch of the tree
> and commit your changes to that.

I've just tagged the files with htdig-3-2-0-b4
-- 
Dan Langille
The FreeBSD Diary - http://freebsddiary.org/ - practical examples

Re: [htdig-dev] HEADS UP: php wrapper script - potential exploit patched

[Gilles D. <gr...@sc...>]

According to Dan Langille:
> On 12 Oct 2001 at 14:53, Gilles Detillieux wrote:
> > According to Dan Langille:
> > > I have just committed a fix to the php-wrapper.  This may or may not
> > > have been a potential exploit.  The fix prevents people from including
> > > arbitrary HTML or PHP code in their search string.  The fix
> > > strips such tags from the input string.
> > 
> > OK, but I thought I should point out that you're still committing to
> > the main branch of the htdig source tree, which hasn't seen any activity
> > since Feb 2000.  If you want your wrapper to be included in the 3.2.0b4
> > development, you have to check out the "htdig-3-2-x" branch of the tree
> > and commit your changes to that.
> 
> I've just tagged the files with htdig-3-2-0-b4

OK, I'm not that versed in CVS, but doesn't this mean that your commits
will only be seen by people who check out the htdig tree using that tag.
As far as I know, that tag hasn't been used by anyone else.  Is this
correct, Geoff, or am I confusing tags and branches?

-- 
Gilles R. Detillieux              E-mail: <gr...@sc...>
Spinal Cord Research Centre       WWW:    http://www.scrc.umanitoba.ca/~grdetil
Dept. Physiology, U. of Manitoba  Phone:  (204)789-3766
Winnipeg, MB  R3E 3J7  (Canada)   Fax:    (204)789-3930