CVS: tmda-cgi/htdocs defaults.ht,1.9,1.10 defaults.html,1.9,1.10
Gre7g Luterman <[email protected]>
| Newsgroups | gmane.mail.spam.tmda.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/tmda/tmda-cgi/htdocs
In directory sc8-pr-cvs1:/tmp/cvs-serv756/htdocs
Modified Files:
defaults.ht defaults.html
Log Message:
Made sure users can only edit/view files in approved directories.
Index: defaults.ht
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/htdocs/defaults.ht,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- defaults.ht 18 Aug 2003 23:34:53 -0000 1.9
+++ defaults.ht 23 Aug 2003 18:55:52 -0000 1.10
@@ -77,6 +77,9 @@
<td><a href="#ViewPendingEmailClass">ViewPending:EmailClass</a></td>
<td><a href="#ViewPendingHeaders">ViewPending:Headers</a></td>
</tr>
+ <tr>
+ <td><a href="#AccessPaths">AccessPaths</a></td>
+ </tr>
</table>
<h4><a name="NoOverrideInstallBackupTGZ"></a>NoOverride:InstallBackupTGZ</h4>
@@ -508,4 +511,42 @@
</tr>
</table>
<p>Default: <tt>short</tt></p>
+</blockquote>
+
+<h4><a name="AccessPaths"></a>AccessPaths</h4>
+<blockquote>
+ <p>tmda-cgi allows users to view and/or edit text files such as filters,
+ lists, configuration files, and templates. These editors/viewers could be
+ exploited by a devious user. To minimize your risk, the AccessPaths
+ section allows you to specify where these files may be located. Unless a
+ full file path matches one of the regular expressions listed, it will not be
+ brought up in an text box.</p>
+ <p><b><i>Note:</i></b> If you do not trust your users, be sure to set
+ either</p>
+ <p><tt>defaults.ini</tt>:
+ <table class="example">
+ <tr>
+ <td>[NoOverride]<br>
+ MayEditLocalConfig = No</td>
+ </tr>
+ </table>
+ <p>or</p>
+ <p><tt>/etc/tmdarc</tt>:
+ <table class="example">
+ <tr>
+ <td>CONFIG_EXEC = 0</td>
+ </tr>
+ </table>
+ <p>A devious user could easily put executable code in their local
+ configuration file which would allow them access to any file not protected
+ by restrictive file permissions.</p>
+
+ <p>Default:
+ <table class="example">
+ <tr>
+ <td>[AccessPaths]<br>
+ A = ^%(Home)s/<br>
+ B = ^/etc/tmdarc$</td>
+ </tr>
+ </table>
</blockquote>
Index: defaults.html
===================================================================
RCS file: /cvsroot/tmda/tmda-cgi/htdocs/defaults.html,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- defaults.html 18 Aug 2003 23:34:53 -0000 1.9
+++ defaults.html 23 Aug 2003 18:55:52 -0000 1.10
@@ -2,7 +2,7 @@
<?xml-stylesheet href="display/styles.css" type="text/css"?>
<html>
<!-- THIS PAGE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -->
-<!-- Mon Aug 18 18:33:37 2003 -->
+<!-- Sat Aug 23 13:51:24 2003 -->
<!-- USING HT2HTML 2.1 -->
<!-- SEE http://ht2html.sf.net -->
<!-- User-specified headers:
@@ -170,6 +170,9 @@
<td><a href="#ViewPendingEmailClass">ViewPending:EmailClass</a></td>
<td><a href="#ViewPendingHeaders">ViewPending:Headers</a></td>
</tr>
+ <tr>
+ <td><a href="#AccessPaths">AccessPaths</a></td>
+ </tr>
</table>
<h4><a name="NoOverrideInstallBackupTGZ"></a>NoOverride:InstallBackupTGZ</h4>
@@ -601,6 +604,44 @@
</tr>
</table>
<p>Default: <tt>short</tt></p>
+</blockquote>
+
+<h4><a name="AccessPaths"></a>AccessPaths</h4>
+<blockquote>
+ <p>tmda-cgi allows users to view and/or edit text files such as filters,
+ lists, configuration files, and templates. These editors/viewers could be
+ exploited by a devious user. To minimize your risk, the AccessPaths
+ section allows you to specify where these files may be located. Unless a
+ full file path matches one of the regular expressions listed, it will not be
+ brought up in an text box.</p>
+ <p><b><i>Note:</i></b> If you do not trust your users, be sure to set
+ either</p>
+ <p><tt>defaults.ini</tt>:
+ <table class="example">
+ <tr>
+ <td>[NoOverride]<br>
+ MayEditLocalConfig = No</td>
+ </tr>
+ </table>
+ <p>or</p>
+ <p><tt>/etc/tmdarc</tt>:
+ <table class="example">
+ <tr>
+ <td>CONFIG_EXEC = 0</td>
+ </tr>
+ </table>
+ <p>A devious user could easily put executable code in their local
+ configuration file which would allow them access to any file not protected
+ by restrictive file permissions.</p>
+
+ <p>Default:
+ <table class="example">
+ <tr>
+ <td>[AccessPaths]<br>
+ A = ^%(Home)s/<br>
+ B = ^/etc/tmdarc$</td>
+ </tr>
+ </table>
</blockquote>
</td>
<!-- end of body cell -->
_______________________________________
tmda-cvs mailing list
http://tmda.net/lists/listinfo/tmda-cvs