diff options
Diffstat (limited to 'Master/texmf/web2c')
| -rw-r--r-- | Master/texmf/web2c/texmf.cnf | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf index 4259f954d1c..e430efe55a2 100644 --- a/Master/texmf/web2c/texmf.cnf +++ b/Master/texmf/web2c/texmf.cnf @@ -485,7 +485,7 @@ engine = unsetengine try_std_extension_first = t % Enable system commands via \write18{...}. When enabled fully (set to -% 1), obviously insecure. When enabled partially (set to p), only the +% t), obviously insecure. When enabled partially (set to p), only the % commands listed in shell_escape_commands are allowed. Although this % is not fully secure either, it is much better, and so useful that we % enable it for everything but bare tex. @@ -495,9 +495,15 @@ shell_escape = f % any output files, respect openout_any, or have hard-coded restrictions similar % or higher to openout_any=p. And have no features (nor, to the best of our % knowledge, obvious security holes) to invoke arbitrary other programs. +% +% Unfortunately we found too many problems with shell_escape=p, so it +% should be treated as though it were just as dangerous as shell_escape=t. shell_escape_commands = \ -kpsewhich,fc-match,\ -repstopdf,\ +false + +% These programs are our first goal when we can enable it. +%kpsewhich,fc-match,\ +%repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. |