From: Wietse Venema (wietseporcupine.org)
Date: Wed Apr 14 2004 - 11:52:24 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Geoff Gibbs:
> > > I was checking that my NIS+ patch was still ok, and have updated
> > > the open flags. However, I used to provide a sample-nisplus.cf
> > > file, to go with the standard ones. As these are no longer
> > > provided in 2.1, is the prefered approach now to put the
> > > information in a README file?
>
> > Yes, that would be the preferred approach.
>
> Can I tell people to :-
>
> echo '$readme_directory/NISPLUS_README:f:root:-:644' >> conf/postfix-files

That will work; the format changes occasionally. These changes
affect only a few entries because I am a lazy person and I don't
want to have to re-create the file all the time.

> as I see that postfix-files has a warning :-
>
> # Do not edit this file.

It's not meant to be edited by users (unlike main.cf or master.cf).

I looked at the code in a little detail, and I have only one question
before I would consider adopting it in the 2.2 snapshots. In the
code below,

    if (strpbrk (key, "[]()<>%,;:!") != 0)
    {
        if (msg_verbose)
                    msg_info("%s contains dubious characters.", key);
        return (0);
    }

Is there a Solaris document that specifies what characters are safe
to use in a NIS+ query? Is it 8-bit safe? Is there a way to
quote characters as with LDAP and *SQL?

I would feel more comfortable using an ALLOW filter or proper quoting,
instead of releasing code that vulnerable due to some oversight.

        Wietse

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]