From d154726bc10c12420d179dc76b87eb1ba8c12709 Mon Sep 17 00:00:00 2001 From: Colin Kuskie Date: Sun, 30 Jul 2006 18:10:31 +0000 Subject: [PATCH] Remove the use trace line from Paginator.t. It's not used. Yet again, fix a security hole in the Include macro. If the path used a symlink then it would bypass one of the three security checks. --- lib/WebGUI/Macro/Include.pm | 2 +- t/Paginator.t | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/WebGUI/Macro/Include.pm b/lib/WebGUI/Macro/Include.pm index 56284f125..5c1ed5a7b 100644 --- a/lib/WebGUI/Macro/Include.pm +++ b/lib/WebGUI/Macro/Include.pm @@ -40,7 +40,7 @@ sub process { my (@param, $temp, $file); @param = @_; my $i18n = WebGUI::International->new($session,'Macro_Include'); - if ($param[0] =~ /passwd/i || $param[0] =~ /shadow/i || $param[0] =~ m!WebGUI/etc/\w+\.conf!i) { + if ($param[0] =~ /passwd/i || $param[0] =~ /shadow/i || $param[0] =~ m!/etc/\w+\.conf!i) { return $i18n->get('security'); } $file = FileHandle->new($param[0],"r"); diff --git a/t/Paginator.t b/t/Paginator.t index 8a8ba45c4..7f28ed128 100644 --- a/t/Paginator.t +++ b/t/Paginator.t @@ -9,7 +9,6 @@ #------------------------------------------------------------------- use FindBin; -use trace; use strict; use lib "$FindBin::Bin/lib";