Exmh releases, and a large bunch of small changes in the exmh tree...

(Read on, important stuff (point 4) towards the bottom)

I had a longish weekend with nothing to do, so I started hacking some more code.

And as often happens, I got diverted off the original goal, which was to fix the
remaining bugs in the separate-window for ftoc and/or msg code.  What I just
dropped into the CVS tree:

1) A bunch of html and doc fixes, some typos, broken links, bad color choices
(somebody thought #fffff0 was visible against 'white' :) and the like.

2) misc/README.mybogo.tcl was both crufty and outright wrong, plus it didn't
support spamassassin, so I fixed the bogo.tcl already in the lib/ tree. :)
There should now be a Preferences for 'Bayesian spam filter', and the Message
window should now have a Spam... menu.  Still to do:

2a) Come up with a clever way to hide or grey out the Spam... menu if
the user hasn't configured it in Preferences.

2b) the original mybogo.tcl talked about adding key bindings - anybody think
that's a good/bad idea?  Easy enough to do, but consensus would be nice.

2c) Buglet - you can't feed an entire folder to the spam filter unless you
select at least one message.  A better fix would probably be to move the
'entire folder' variants from the mops list to the fops list...

3) I did a mass cleanup of a lot of places where we were doing things like
'exec chown' or 'exec rm', and changed them to equivalent native Tcl 'file'
calls.  This was for 2 reasons:  (a) just clean up and efficiency, and (b) (leading
in to the next point...)

4) I did a fairly extensive security audit, and found some *nasty* bugs about a
week or so ago - basically, an attacker could manage to pass fairly arbitrary
text to an 'exec' call in a number of places.  The two biggest got patched in
CVS a week ago, stashed under some other actual bug fixes for mime.tcl.  I wanted
to try to keep the cat in the bag until I was able to deal with the other 'exec'
calls.

The security hole is pretty big - it can be triggered by a remote attacker with a
specially crafted piece of malformed MIME.

Given that the hole was a metamail-related one, maybe that's even more reason
to find an alternate base64 {en,de}coder and heave all the Metamail code over the side.

I think the hole is big enough to merit a 2.7.1 release at least - what do others
think?

_______________________________________________
Exmh-workers mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/exmh-workers

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFBBVMlcC3lWbTT17ARAqT3AKD5SzGcQd0Ln+UdFL0K2iBbINIHWgCfTp/D
Gygd+h8gLSYA501hEqO17t8=
=dLEp
-----END PGP SIGNATURE-----