This patch removes the misfeature in resend that looks for an absolute
path in the approve_passwd or -a string to use as a file containing the
actual password. Such a pathname is a security risk, can't be managed
remotely, and, if set to the list.passwd file, is a security trap for
the naive.
--- resend.orig Mon Dec 23 09:04:45 1996
+++ resend Wed Jan 1 15:18:52 1997
@@ -191,16 +191,6 @@
&set_abort_addr($sender);
&set_log($log, $opt_h, "resend", $opt_l);
-# if approve_passwd (or -a) starts with a leading /, there is a file
-# that holds the password.
-#
-if (defined($opt_a)) {
- if ($opt_a =~ /^\//) {
- open(PWD, $opt_a) || die("resend: open(PWD, \"$opt_a\"): $!");
- $opt_a = &chop_nl(<PWD>);
- }
-}
-
if (defined($opt_A) && ! defined($opt_a)) {
die("resend: must also specify '-a passwd' if using '-A' flag");
}
--
Dave Wolfe
|
|