summaryrefslogtreecommitdiff
path: root/Master/texmf/web2c/texmf.cnf
diff options
context:
space:
mode:
Diffstat (limited to 'Master/texmf/web2c/texmf.cnf')
-rw-r--r--Master/texmf/web2c/texmf.cnf38
1 files changed, 17 insertions, 21 deletions
diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf
index f216f47e7e9..1f91423e905 100644
--- a/Master/texmf/web2c/texmf.cnf
+++ b/Master/texmf/web2c/texmf.cnf
@@ -4,8 +4,8 @@
% If you modify this original file, YOUR CHANGES WILL BE LOST when it is
% updated. Instead, put your changes -- and only your changes, not an
% entire copy of the full texmf.cnf! -- in ../../texmf.cnf. That is, if
-% this file is installed in /some/path/to/texlive/2009/texmf/web2c/texmf.cnf,
-% add your custom settings to /some/path/to/texlive/2009/texmf.cnf.
+% this file is installed in /some/path/to/texlive/2010/texmf/web2c/texmf.cnf,
+% add your custom settings to /some/path/to/texlive/2010/texmf.cnf.
%
% What follows is a super-summary of what this .cnf file can
% contain. Please read the Kpathsea manual for more information.
@@ -89,7 +89,7 @@ TEXMFHOME = ~/texmf
% TEXMFVAR = $TEXMFMAIN
% For using a separate tree:
% TEXMFVAR = ~/.texmf-var # teTeX 3.0 default
-TEXMFVAR = ~/.texlive2009/texmf-var
+TEXMFVAR = ~/.texlive2010/texmf-var
% TEXMFCONFIG, where texconfig stores configuration data.
% With teTeX-3.0 or later, this must be set.
@@ -99,7 +99,7 @@ TEXMFVAR = ~/.texlive2009/texmf-var
% TEXMFCONFIG = ~/.texmf-config # teTeX 3.0 default
% For using a separate tree:
% TEXMFCONFIG = $SELFAUTOPARENT/texmf-config
-TEXMFCONFIG = ~/.texlive2009/texmf-config
+TEXMFCONFIG = ~/.texlive2010/texmf-config
% Now, list all the texmf trees. If you have multiple trees you can
% use shell brace notation, like this:
@@ -234,12 +234,12 @@ TEXINPUTS.lamed = .;$TEXMF/tex/{lamed,lambda,latex,generic,}//
TEXINPUTS.omega = .;$TEXMF/tex/{plain,generic,}//
% pTeX
-TEXINPUTS.ptex = .;$TEXMF/{ptex/{plain,generic},tex/{plain,generic,}}//
-TEXINPUTS.platex = .;$TEXMF/{ptex/platex,{p,}tex/latex,{p,}tex/generic,{p,}tex}//
+TEXINPUTS.ptex = .;$TEXMF/tex/{ptex,ptexgeneric,plain,generic,}//
+TEXINPUTS.platex = .;$TEXMF/tex/{platex,ptexgeneric,latex,generic,}//
% pBibTeX bibliographies and style files
-BIBINPUTS.pbibtex = .;$TEXMF/{pbibtex,bibtex}/bib//
-BSTINPUTS.pbibtex = .;$TEXMF/{pbibtex,bibtex}/bst//
+BIBINPUTS.pbibtex = .;$TEXMF/{pbibtex,bibtex}/bib//
+BSTINPUTS.pbibtex = .;$TEXMF/{pbibtex,bibtex}/bst//
% ConTeXt.
TEXINPUTS.context = .;$TEXMF/tex/{context,plain,generic,}//
@@ -496,7 +496,7 @@ try_std_extension_first = t
% commands listed in shell_escape_commands are allowed. Although this
% is not fully secure either, it is much better, and so useful that we
% enable it for everything but bare tex.
-shell_escape = f
+shell_escape = p
% No spaces in this command list. These programs either do not write
% any output files, respect openout_any, or have hard-coded restrictions similar
@@ -506,28 +506,24 @@ shell_escape = f
% Unfortunately we found too many problems with shell_escape=p, so it
% should be treated as though it were just as dangerous as shell_escape=t.
shell_escape_commands = \
-false
-
-% These programs are our first goal when we can enable it.
-%kpsewhich,fc-match,\
-%repstopdf,\
+bibtex,bibtex8,\
+kpsewhich,\
+makeindex,\
+repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.
% epspdf, ps2pdf, pstopdf - need to respect openout_any,
-% and we need to make sure -dSAFER is used and no injection is possible.
+% and gs -dSAFER must be used and check for shell injection with filenames.
% (img)convert (ImageMagick) - delegates.mgk possible misconfig, besides,
% without Unix convert it hardly seems worth it, and Windows convert
-% is something completely different that destroys filesystems, so
-% skip it.
+% is something completely different that destroys filesystems, so skip.
% pygmentize - but is the filter feature insecure?
% ps4pdf - but it calls an unrestricted latex.
+% rpdfcrop - maybe ok, but let's get experience with repstopdf first.
% texindy,xindy - but is the module feature insecure?
% ulqda - but requires optional SHA1.pm, so why bother.
-% tex, latex, etc. - but need to forbid --shell-escape, and inherit openout_any
-%
-% repstopdf, rpdfcrop - maybe ok
-% bibtex,bibtex8,makeindex - maybe ok
+% tex, latex, etc. - need to forbid --shell-escape, and inherit openout_any.
% plain TeX should remain unenhanced.
shell_escape.tex = f