Bug#980451: Execution of commands from the configuration file through backtick syntax

[Stefan Hornburg (Racke)]

package: sympa
severity: important
tags: security, patch

Upstream bug report: https://github.com/sympa-community/sympa/issues/1086

Regards
        Racke

-- 
Ecommerce and Linux consulting + Perl and web application programming.
Debian and Sympa administration. Provisioning with Ansible.

diff --git a/src/lib/Conf.pm b/src/lib/Conf.pm
index ce5ce13d0..e8f99cc3a 100644
--- a/src/lib/Conf.pm
+++ b/src/lib/Conf.pm
@@ -1728,12 +1728,6 @@ sub _load_config_file_to_hash {
             my ($keyword, $value) = ($1, $2);
             $value =~ s/\s*$//;
 
-            # Special case: `command`
-            if ($value =~ /^\`(.*)\`$/) {
-                $value = qx/$1/;
-                chomp($value);
-            }
-
             $keyword =
                 $Sympa::Config::Schema::obsolete_robot_params{$keyword}
                 // $keyword;

OpenPGP_signature
Description: OpenPGP digital signature