Re: [htdig-dev] HEADS UP: php wrapper script - potential exploit patched

[Gilles D. <gr...@sc...>]

According to Dan Langille:
> I have just committed a fix to the php-wrapper.  This may or may not
> have been a potential exploit.  The fix prevents people from including
> arbitrary HTML or PHP code in their search string.  The fix
> strips such tags from the input string.

OK, but I thought I should point out that you're still committing to
the main branch of the htdig source tree, which hasn't seen any activity
since Feb 2000.  If you want your wrapper to be included in the 3.2.0b4
development, you have to check out the "htdig-3-2-x" branch of the tree
and commit your changes to that.

At some point, Geoff is going to fold this branch back into the main
branch, but this hasn't happened yet.

-- 
Gilles R. Detillieux              E-mail: <gr...@sc...>
Spinal Cord Research Centre       WWW:    http://www.scrc.umanitoba.ca/~grdetil
Dept. Physiology, U. of Manitoba  Phone:  (204)789-3766
Winnipeg, MB  R3E 3J7  (Canada)   Fax:    (204)789-3930