talons

commit 8a56b78f5ed534178517ade114bb664e24fa8e58
parent 347bb9db97ca9348de8bc5e61b12cdc0b100aedd
Author: Colin Leroy <colin@colino.net>
Date:   Fri,  8 Feb 2008 16:28:22 +0000

2008-02-08 [colin]	3.3.0cvs1

	* src/common/utils.c
		Forbid attaching anything containing "../" or ".ssh/"
		from mailto: URI

Diffstat:
M
ChangeLog
 | 
6
++++++
M
PATCHSETS
 | 
1
+
M
configure.ac
 | 
2
+-
M
src/common/utils.c
 | 
2
++

4 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,9 @@
+2008-02-08 [colin]	3.3.0cvs1
+
+	* src/common/utils.c
+		Forbid attaching anything containing "../" or ".ssh/"
+		from mailto: URI
+
 2008-02-08 [paul]	3.3.0
 
 	* NEWS
diff --git a/PATCHSETS b/PATCHSETS
@@ -3214,3 +3214,4 @@
 ( cvs diff -u -r 1.274.2.231 -r 1.274.2.232 src/mainwindow.c;  ) > 3.2.0cvs75.patchset
 ( cvs diff -u -r 1.94.2.169 -r 1.94.2.170 src/messageview.c;  cvs diff -u -r 1.83.2.126 -r 1.83.2.127 src/mimeview.c;  cvs diff -u -r 1.20.2.23 -r 1.20.2.24 src/mimeview.h;  ) > 3.2.0cvs76.patchset
 ( cvs diff -u -r 1.100.2.59 -r 1.100.2.60 AUTHORS;  cvs diff -u -r 1.654.2.3272 -r 1.654.2.3274 configure.ac;  cvs diff -u -r 1.9.2.12 -r 1.9.2.13 po/cs.po;  cvs diff -u -r 1.58.2.36 -r 1.58.2.37 po/de.po;  cvs diff -u -r 1.60.2.50 -r 1.60.2.51 po/es.po;  cvs diff -u -r 1.1.2.16 -r 1.1.2.17 po/fi.po;  diff -u /dev/null po/he.po;  cvs diff -u -r 1.5.2.9 -r 1.5.2.10 po/hu.po;  cvs diff -u -r 1.34.2.25 -r 1.34.2.26 po/it.po;  cvs diff -u -r 1.50.2.29 -r 1.50.2.30 po/pt_BR.po;  cvs diff -u -r 1.5.2.26 -r 1.5.2.27 po/zh_CN.po;  cvs diff -u -r 1.4.2.59 -r 1.4.2.60 src/gtk/about.c;  cvs diff -u -r 1.1.2.45 -r 1.1.2.46 src/gtk/authors.h;  ) > 3.2.0cvs77.patchset
+( cvs diff -u -r 1.36.2.134 -r 1.36.2.135 src/common/utils.c;  ) > 3.3.0cvs1.patchset
diff --git a/configure.ac b/configure.ac
@@ -11,7 +11,7 @@ MINOR_VERSION=3
 MICRO_VERSION=0
 INTERFACE_AGE=0
 BINARY_AGE=0
-EXTRA_VERSION=0
+EXTRA_VERSION=1
 EXTRA_RELEASE=
 EXTRA_GTK2_VERSION=
 
diff --git a/src/common/utils.c b/src/common/utils.c
@@ -1522,6 +1522,8 @@ gint scan_mailto_url(const gchar *mailto, gchar **from, gchar **to, gchar **cc, 
 	const gchar *forbidden_uris[] = { ".gnupg/",
 					  "/etc/passwd",
 					  "/etc/shadow",
+					  ".ssh/",
+					  "../",
 					  NULL };
 	gint num_attach = 0;
 	gchar **my_att = NULL;