summaryrefslogtreecommitdiff
path: root/Build/source/texk/kpathsea/texmf.cnf
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/texk/kpathsea/texmf.cnf')
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf12
1 files changed, 9 insertions, 3 deletions
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 4259f954d1c..e430efe55a2 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -485,7 +485,7 @@ engine = unsetengine
try_std_extension_first = t
% Enable system commands via \write18{...}. When enabled fully (set to
-% 1), obviously insecure. When enabled partially (set to p), only the
+% t), obviously insecure. When enabled partially (set to p), only the
% commands listed in shell_escape_commands are allowed. Although this
% is not fully secure either, it is much better, and so useful that we
% enable it for everything but bare tex.
@@ -495,9 +495,15 @@ shell_escape = f
% any output files, respect openout_any, or have hard-coded restrictions similar
% or higher to openout_any=p. And have no features (nor, to the best of our
% knowledge, obvious security holes) to invoke arbitrary other programs.
+%
+% Unfortunately we found too many problems with shell_escape=p, so it
+% should be treated as though it were just as dangerous as shell_escape=t.
shell_escape_commands = \
-kpsewhich,fc-match,\
-repstopdf,\
+false
+
+% These programs are our first goal when we can enable it.
+%kpsewhich,fc-match,\
+%repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.