discourage shell_escape=p

git-svn-id: svn://tug.org/texlive/trunk@15842 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 9 insertions, 3 deletions

diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf
index 4259f954d1c..e430efe55a2 100644
--- a/Master/texmf/web2c/texmf.cnf
+++ b/Master/texmf/web2c/texmf.cnf
@@ -485,7 +485,7 @@ engine = unsetengine
 try_std_extension_first = t
 
 % Enable system commands via \write18{...}.  When enabled fully (set to
-% 1), obviously insecure.  When enabled partially (set to p), only the
+% t), obviously insecure.  When enabled partially (set to p), only the
 % commands listed in shell_escape_commands are allowed.  Although this
 % is not fully secure either, it is much better, and so useful that we
 % enable it for everything but bare tex.
@@ -495,9 +495,15 @@ shell_escape = f
 % any output files, respect openout_any, or have hard-coded restrictions similar
 % or higher to openout_any=p.  And have no features (nor, to the best of our
 % knowledge, obvious security holes) to invoke arbitrary other programs.
+% 
+% Unfortunately we found too many problems with shell_escape=p, so it
+% should be treated as though it were just as dangerous as shell_escape=t.
 shell_escape_commands = \
-kpsewhich,fc-match,\
-repstopdf,\
+false
+
+% These programs are our first goal when we can enable it.
+%kpsewhich,fc-match,\
+%repstopdf,\
 
 % we'd like to allow:
 % dvips - but external commands can be executed, need at least -R1.