severity 496430 wishlist
retitle 496430 please replace insecure debug code in redirect.pl
thanks

The code is insecure but only used when $debug=1, which is hardcoded to 0, so 
only the user editing files under /usr/lib is affected by this, which we 
don't support. Still, it would be good if this code could be replaced with 
something more secure, to make it safe even for debuggers and to prevent the 
code to be copied to other places where it can cause security issues.


Thijs

Attachment: pgpfshsbqaaSp.pgp
Description: PGP signature

Reply via email to