Re: [WWdevel] [WWcvs] pg: SECURITY: tighter constraints on which macro files can be loaded without restriction.

[Davide P. C. <dp...@un...>]

> This is the second attempt to close this hole. The previous attempt
> assumed that | binds tighter than ^ and $, which is not true. (Noticed
> by dpvc). It also failed to escape metacharacters in the file names.

One last thing with this:  I don't know if quotemeta does anything  
with dots, but the dots in the file names will match any character  
unless they are quoted to \. So "IO-pl" would load in unsafe mode.

Davide