This patch fixes an obscure bug in the following versions of INN. 1.5 Thanks to Matt Power for finding this and supplying the fix. James Brister inn@isc.org --------------------------------------------------------------------------- *** parsecontrol.old Fri Nov 29 18:32:18 1996 --- parsecontrol Tue Dec 3 01:50:43 1996 *************** *** 15,21 **** az=abcdefghijklmnopqrstuvwxyz ZN=0123456789 # Attempt to sanitize the address ! FROM="`echo \"$1\" | tr ${AZ} ${az} | tr -dc ${az}${ZN}+-_.@%`" REPLYTO="$2" case "$3" in "") --- 15,21 ---- az=abcdefghijklmnopqrstuvwxyz ZN=0123456789 # Attempt to sanitize the address ! FROM="`echo \"$1\" | tr ${AZ} ${az} | tr -dc \\\055${az}${ZN}+_.@%`" REPLYTO="$2" case "$3" in "") *************** *** 55,60 **** --- 55,76 ---- writelog $MOST_LOGS/badcontrol.log "`date` Bad header by ${FROM}" exit fi + fi + + # Check characters in values of variables that will be inside an eval + TRANS1="`echo \"$1\" | tr ${AZ} ${az} | tr -dc \\\055${az}${ZN}+_.`" + if [ ${1}X != ${TRANS1}X ]; then + rm -f ${TEMP} + ${SED} -e 's/^~/~~/' < ${ARTICLE} \ + | ${MAILCMD} -s "Malformed newsgroup name by ${FROM}" ${NEWSMASTER} + exit + fi + TRANSP="`echo \"$PROG\" | tr ${AZ} ${az} | tr -dc \\\055${az}${ZN}+_.`" + if [ ${PROG}X != ${TRANSP}X ]; then + rm -f ${TEMP} + ${SED} -e 's/^~/~~/' < ${ARTICLE} \ + | ${MAILCMD} -s "Unexpected program name by ${FROM}" ${NEWSMASTER} + exit fi ACTION=mail