Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
3 check-ins using file window.c version 3c2d67bf9c
|
2000-10-21
| ||
| 12:52 | Ooh. Actually, that vulnerability is further-reaching than I thought. As well as the ".." attack in recursive copies, the name sent by the client was also trusted in a single-file implicit- destination copy such as "pscp host:foo .". (The result was ./foo, where foo is what the server claimed the file was rather than what the user asked for. I think it's not unreasonable that if the user requests file `foo' from the host, he should get the result in a file called `foo' no matter what the host thinks.) check-in: 45b7073ca1 user: simon tags: trunk | |
| 12:36 | Fix a potential vulnerability in incoming `pscp -r'. The server sends filenames of things in the directory being copied. A malicious server could have sent, for example, "..\..\windows\system\foo.dll" and overwritten something crucial. The filenames are now vetted to ensure they don't contain slashes or backslashes. check-in: fb06cc0f0f user: simon tags: trunk | |
| 11:30 | Three new configurable options: - Robert de Bath's Compose key is now off by default and configurable on - The ages-old controversy over whether ALT by itself should bring the System menu up is now controllable by a config option - You can now independently configure whether scrollback resets on a keypress _and_ whether it resets on screen activity. check-in: 36e1cf31e3 user: simon tags: trunk | |