summaryrefslogtreecommitdiff
path: root/Master/texmf
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2009-10-19 23:12:04 +0000
committerKarl Berry <karl@freefriends.org>2009-10-19 23:12:04 +0000
commit03070f532392d9e24d8dc2b79df0c626abc599f0 (patch)
tree85616f6df4bc041f6b4a836e6c48378bd03cba72 /Master/texmf
parent2ff608c5f5540874f31bb0119f2a277b4cc2ae91 (diff)
discourage shell_escape=p
git-svn-id: svn://tug.org/texlive/trunk@15842 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/texmf')
-rw-r--r--Master/texmf/web2c/texmf.cnf12
1 files changed, 9 insertions, 3 deletions
diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf
index 4259f954d1c..e430efe55a2 100644
--- a/Master/texmf/web2c/texmf.cnf
+++ b/Master/texmf/web2c/texmf.cnf
@@ -485,7 +485,7 @@ engine = unsetengine
try_std_extension_first = t
% Enable system commands via \write18{...}. When enabled fully (set to
-% 1), obviously insecure. When enabled partially (set to p), only the
+% t), obviously insecure. When enabled partially (set to p), only the
% commands listed in shell_escape_commands are allowed. Although this
% is not fully secure either, it is much better, and so useful that we
% enable it for everything but bare tex.
@@ -495,9 +495,15 @@ shell_escape = f
% any output files, respect openout_any, or have hard-coded restrictions similar
% or higher to openout_any=p. And have no features (nor, to the best of our
% knowledge, obvious security holes) to invoke arbitrary other programs.
+%
+% Unfortunately we found too many problems with shell_escape=p, so it
+% should be treated as though it were just as dangerous as shell_escape=t.
shell_escape_commands = \
-kpsewhich,fc-match,\
-repstopdf,\
+false
+
+% These programs are our first goal when we can enable it.
+%kpsewhich,fc-match,\
+%repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.