* Various changes to make debbugs-local work better (Closes: #585796)

  - Add libnet-server-fork-perl to Depends for debbugs-local
  - Sanitize env in -T code

diff --git a/cgi/bugreport.cgi b/cgi/bugreport.cgi
index 8692146485297e70cf3bd9e83f255c16056d028e..8ad688f6923b501ea836557574b2a63f881c738a 100755 (executable)
--- a/cgi/bugreport.cgi
+++ b/cgi/bugreport.cgi
@@ -1,8 +1,13 @@
-#!/usr/bin/perl -wT
+#!/usr/bin/perl
 
 use warnings;
 use strict;
 
+# Sanitize environent for taint
+BEGIN{
+    delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
+}
+
 use POSIX qw(strftime);
 use MIME::Parser;
 use MIME::Decoder;

diff --git a/cgi/pkgreport.cgi b/cgi/pkgreport.cgi
index b70a5cb6b997dd06ee3629471fe055ec2b90384b..4f4ea800af986fcd38f0c58ba04dd8e121a41a95 100755 (executable)
--- a/cgi/pkgreport.cgi
+++ b/cgi/pkgreport.cgi
@@ -13,6 +13,11 @@
 use warnings;
 use strict;
 
+# Sanitize environent for taint
+BEGIN{
+    delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
+}
+
 use POSIX qw(strftime nice);
 
 use Debbugs::Config qw(:globals :text :config);

diff --git a/debian/changelog b/debian/changelog
index 923c161536929dc69d3ccf9f66657a61750b2bab..ae5278c784f03bda2b10cedc0da05c505aa7aed9 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -29,6 +29,9 @@ debbugs (2.4.2~exp1) experimental; urgency=low
     Wirzenius
   * Don't RFC1522 escape ", ( and ). (Closes: #588859). Thanks to Glenn
     Morris
+  * Various changes to make debbugs-local work better (Closes: #585796) 
+    - Add libnet-server-fork-perl to Depends for debbugs-local
+    - Sanitize env in -T code
 
  -- Don Armstrong <don@debian.org>  Wed, 26 Aug 2009 21:32:53 -0700