Re: [Bug-wget] Wget - acess list bypass / race condition PoC

2016-08-15 Thread moparisthebest
Hello, I find it extremely hard to call this a wget vulnerability when SO many other things are wrong with that 'vulnerable code' implementation it isn't even funny: 1. The image_importer.php script takes a single argument, why would it download with the recursive switch turned on? Isn't that

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-04-04 Thread moparisthebest
that supposedly does that, but it's not working for me, likely because I'm doing something wrong... Let me know if there is anything else I can do. Thanks, Travis On 03/18/2016 02:10 AM, moparisthebest wrote: > Hi Tim, > > I've implemented your suggestions below, except the python tests, and

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-03-19 Thread moparisthebest
file. It also allows for stdin ('-' at the command line) which > makes the new option a bit more consistent with Wget's CLI standards. > > Do you plan to create a python test (see testenv/) ? > > Regards, Tim > > On Monday 14 March 2016 12:57:52 moparisthebest wrote: >

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-03-18 Thread moparisthebest
And of course NOW I see the Test--https.py file and that https tests are indeed supported. I'll write up some tests and send them shortly. On 03/18/2016 02:10 AM, moparisthebest wrote: > The documentation in testenv/ says the test server doesn't support > https, which would be

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-03-15 Thread moparisthebest
Hi Tim, On 03/15/2016 07:50 AM, Tim Ruehsen wrote: > In wg_pin_peer_pubkey(), what is this loop do {...} while(0) about ? > I looks like it is not supposed to loop (if it would, we had resource leaks). > Maybe you can remove it and instead of 'break: do a 'goto end/cleanup/out' !? Ah yea that

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-03-14 Thread moparisthebest
Hi all, Just checking back in about this patch, is there anything else you are waiting on from me before integrating it? Thanks much, Travis signature.asc Description: OpenPGP digital signature

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-02-29 Thread moparisthebest
and maintained automatically, like > with > HSTS ? I guess max-age and includeSubdomains are relevant here, maybe report- > uri. > > Regards, Tim > > Am Dienstag, 23. Februar 2016, 16:10:40 schrieb moparisthebest: >> Hi Tim, >> >> I attempted to implement your sugg

Re: [Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-02-23 Thread moparisthebest
ibution, you have to sign the FSF copyrigth > assignment. We'll send you information on how to proceed via PM. > > Thanks again for your work - it is highly appreciated. > > Regards, Tim > > > Am Dienstag, 23. Februar 2016, 13:17:14 schrieb moparisthebest: >> Hel

[Bug-wget] Implement --pinnedpubkey option to pin public keys

2016-02-23 Thread moparisthebest
be added for this functionality, or if any additional documentation needs updated or anything else? If you can point me to anything else that needs done that would make this easier to accept I'd appreciate it. Thanks for the great tool, Travis Burtrum [1]: https://github.com/moparisthebest/wget [2