LYNX-DEV fix for security hole in lynxexec

[David Trueman]

The following patch disallows the use of .. in paths passed to
lynxexec: or lynxprog: links to circumvent intended secority provisions.

*** 1.1 1996/12/15 20:49:28
--- LYGetFile.c 1996/12/15 20:50:15
***************
*** 920,925 ****
--- 920,927 ----
          HTAlert(MALFORMED_EXEC_REQUEST);
        return FALSE;
      }
+     if (LYstrstr(link, "../") != NULL)
+       return FALSE;
  #ifndef VMS
      /* security: reject on strange character */
      for (cp = link; *cp != '\0'; cp++) {


  David Trueman,
    Systems Manager, Dalhousie Math, Stats and Computing Science
    Technical Chair, Chebucto Community Net

;
; To UNSUBSCRIBE:  Send a mail message to address@hidden
;                  with "unsubscribe lynx-dev" (without the
;                  quotation marks) on a line by itself.
;