Here is a patch for this bug, stolen from [1].  Note that

a) the patch for #480885 that got installed upstream is _not_ sufficient
   in emacs21, because fast-lock-cache-directories can be set in a
   "Local Variables" section, so fast-lock-cache-directories has to be
   marked as risky;

b) the hunk for loaddefs.el in the gentoo patch is not needed, because
   that file is regenerated by the Debian build process.

--8<---------------cut here---------------start------------->8---
--- emacs-21.4-orig/lisp/fast-lock.el   2001-07-15 18:15:34.000000000 +0200
+++ emacs-21.4/lisp/fast-lock.el        2008-05-12 22:43:07.000000000 +0200
@@ -278,7 +278,7 @@
                                      (integer :tag "size")))))
   :group 'fast-lock)
 
-(defcustom fast-lock-cache-directories '("." "~/.emacs-flc")
+(defcustom fast-lock-cache-directories '("~/.emacs-flc")
 ; - `internal', keep each file's Font Lock cache file in the same file.
 ; - `external', keep each file's Font Lock cache file in the same directory.
   "*Directories in which Font Lock cache files are saved and read.
@@ -296,13 +296,18 @@
  ((\"^/your/true/home/directory/\" . \".\") \"~/.emacs-flc\")
 
 would cause a file's current directory to be used if the file is under your
-home directory hierarchy, or otherwise the absolute directory `~/.emacs-flc'."
+home directory hierarchy, or otherwise the absolute directory `~/.emacs-flc'.
+For security reasons, it is not advisable to use the file's current directory
+to avoid the possibility of using the cache of another user."
   :type '(repeat (radio (directory :tag "directory")
                        (cons :tag "Matching"
                              (regexp :tag "regexp")
                              (directory :tag "directory"))))
   :group 'fast-lock)
 
+;;;###autoload
+(put 'fast-lock-cache-directories 'risky-local-variable t)
+
 (defcustom fast-lock-save-events '(kill-buffer kill-emacs)
   "*Events under which caches will be saved.
 Valid events are `save-buffer', `kill-buffer' and `kill-emacs'.
--8<---------------cut here---------------end--------------->8---

Cheers,
       Sven


[1] 
http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo/src/patchsets/emacs/21.4/18_all_fast-lock.patch?rev=1.1



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Reply via email to