diff options
| -rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 4 | ||||
| -rw-r--r-- | Build/source/texk/kpathsea/texmf.cnf | 12 | ||||
| -rw-r--r-- | Master/texmf/web2c/texmf.cnf | 12 |
3 files changed, 22 insertions, 6 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index f9852603f5a..0a17d335407 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,7 @@ +2009-10-20 Karl Berry <karl@tug.org> + + * texmf.cnf (shell_escape): doc fixes to discourage shell_escape=p. + 2009-10-19 Manuel Pégourié-Gonnard <mpg@elzevir.fr> * texmf.cnf: set shell_escape back to 'f': 'p' is broken on Unix. diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index 4259f954d1c..e430efe55a2 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -485,7 +485,7 @@ engine = unsetengine try_std_extension_first = t % Enable system commands via \write18{...}. When enabled fully (set to -% 1), obviously insecure. When enabled partially (set to p), only the +% t), obviously insecure. When enabled partially (set to p), only the % commands listed in shell_escape_commands are allowed. Although this % is not fully secure either, it is much better, and so useful that we % enable it for everything but bare tex. @@ -495,9 +495,15 @@ shell_escape = f % any output files, respect openout_any, or have hard-coded restrictions similar % or higher to openout_any=p. And have no features (nor, to the best of our % knowledge, obvious security holes) to invoke arbitrary other programs. +% +% Unfortunately we found too many problems with shell_escape=p, so it +% should be treated as though it were just as dangerous as shell_escape=t. shell_escape_commands = \ -kpsewhich,fc-match,\ -repstopdf,\ +false + +% These programs are our first goal when we can enable it. +%kpsewhich,fc-match,\ +%repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf index 4259f954d1c..e430efe55a2 100644 --- a/Master/texmf/web2c/texmf.cnf +++ b/Master/texmf/web2c/texmf.cnf @@ -485,7 +485,7 @@ engine = unsetengine try_std_extension_first = t % Enable system commands via \write18{...}. When enabled fully (set to -% 1), obviously insecure. When enabled partially (set to p), only the +% t), obviously insecure. When enabled partially (set to p), only the % commands listed in shell_escape_commands are allowed. Although this % is not fully secure either, it is much better, and so useful that we % enable it for everything but bare tex. @@ -495,9 +495,15 @@ shell_escape = f % any output files, respect openout_any, or have hard-coded restrictions similar % or higher to openout_any=p. And have no features (nor, to the best of our % knowledge, obvious security holes) to invoke arbitrary other programs. +% +% Unfortunately we found too many problems with shell_escape=p, so it +% should be treated as though it were just as dangerous as shell_escape=t. shell_escape_commands = \ -kpsewhich,fc-match,\ -repstopdf,\ +false + +% These programs are our first goal when we can enable it. +%kpsewhich,fc-match,\ +%repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. |