Re: things currently broken/missing

From: Jeroen Ruigrok/asmodai <asmodai(at)wxs(dot)nl>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Robert Treat <xzilla(at)users(dot)sourceforge(dot)net>, "Marc G(dot) Fournier" <scrappy(at)postgresql(dot)org>, pgsql-www(at)postgresql(dot)org
Subject: Re: things currently broken/missing
Date: 2004-02-11 17:27:47
Message-ID: 20040211172747.GR39523@nexus.ninth-circle.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-www

-On [20040211 17:32], Tom Lane (tgl(at)sss(dot)pgh(dot)pa(dot)us) wrote:
>I think we probably ought to leave this turned off. From a security
>standpoint, it would scare me quite a lot for the cgi user to have write
>access to the CVS tree. Even though the annotation software itself may
>do nothing more risky than temporarily locking files, what of bugs that
>might allow someone to make more extensive changes?

Make sure to replace every call to 'cvs' with 'cvs -R'. This enables
read-only repository mode. Or set the relevant environment variable.
Note that cvs 1.12.x is more intelligent about locks.

--
Jeroen Ruigrok van der Werven <asmodai(at)wxs.nl> / asmodai / kita no mono
PGP fingerprint: 2D92 980E 45FE 2C28 9DB7 9D88 97E6 839B 2EAC 625B
http://www.tendra.org/ | http://diary.in-nomine.org/
Expansion of happiness is the purpose of life...

In response to

Browse pgsql-www by date

  From Date Subject
Next Message Jeroen Ruigrok/asmodai 2004-02-11 22:16:19 Re: things currently broken/missing
Previous Message Tom Lane 2004-02-11 16:49:52 Re: things currently broken/missing