Update of /cvsroot/mhonarc/mhonarc/MHonArc/examples
In directory subversions:/tmp/cvs-serv8630/examples
Modified Files:
mhonarc.vim
Log Message:
* New resources:
DBFILEPERMS File permissions for DBFILE.
FILEPERMS File permissions for archive files.
* Archive file creation modified to minimize the local symlink exploits:
1. A temp file with a random name is first created and written to.
2. Temp file is compressed if GZIPFILES is active.
3. Temp file is renamed to final filename.
4. File permissions are set according to FILEPERMS/DBFILEPERMS.
Using a random temp filename makes it difficult for someone to
predict filenames to execute a symlink exploit. The rename operation
is immune to symlink exploits, hence trying to using well-known names
(e.g. maillist.html, threads.html) for exploitation will not work.
Generation of temp files is done via the File::Temp module, if
installed. If not installed, a homegrown implementation is used.
Although not as secure and robust as File::Temp, it's better than
nothing and should provide a decent deterrent.
* Setuid/setgid execution causes mhonarc to terminate with an error.
Mhonarc does not pass taint checks, so we abort with an error that
setuid/setgid execution is not supported. MHonArc is too insecure
for setuid operation and trying to make it setuid-safe would require
alot of work and potentially limit a large amount of functionality.
* Added check for Fcntl and File::Basename modules in FILELIST.
* Added stylesheet for documentation. Main page docs updated to
include class attributes to get desired rendering. Updating
resource reference pages will be done gradually to leverage
style settings. Since there is so many pages, it will be done
on a page-by-page basis. Maybe I can write a perl script that
could auto-add class atteibutes where appropriate.
Index: mhonarc.vim
===================================================================
RCS file: /cvsroot/mhonarc/mhonarc/MHonArc/examples/mhonarc.vim,v
retrieving revision 1.14
retrieving revision 1.15
diff -C2 -r1.14 -r1.15
*** mhonarc.vim 17 Nov 2002 03:38:52 -0000 1.14
--- mhonarc.vim 20 Nov 2002 23:53:11 -0000 1.15
***************
*** 58,61 ****
--- 58,62 ----
syn keyword mhaTagName contained daybegin
syn keyword mhaTagName contained dayend
+ syn keyword mhaTagName contained dbfileperms
syn keyword mhaTagName contained decodeheads
syn keyword mhaTagName contained nodecodeheads
***************
*** 72,75 ****
--- 73,77 ----
syn keyword mhaTagName contained fieldsend
syn keyword mhaTagName contained fieldstyles
+ syn keyword mhaTagName contained fileperms
syn keyword mhaTagName contained firstpglink
syn keyword mhaTagName contained fldbeg
---------------------------------------------------------------------
To sign-off this list, send email to majordomo(_at_)mhonarc(_dot_)org with the
message text UNSUBSCRIBE MHONARC-DEV