From 1ca8dc197ef8c8f4f9873dcc9e65c6a2e7adb5be Mon Sep 17 00:00:00 2001
From: Guillaume Rousse <guillaume.rousse@renater.fr>
Date: Fri, 3 Aug 2018 17:10:25 +0200
Subject: [PATCH] run CGI in taint mode
---
bin/access-check-manager.cgi.in | 2 +-
lib/AccountManager/App.pm | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/bin/access-check-manager.cgi.in b/bin/access-check-manager.cgi.in
index db68c12..d2933fe 100755
--- a/bin/access-check-manager.cgi.in
+++ b/bin/access-check-manager.cgi.in
@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -T
use strict;
use warnings;
diff --git a/lib/AccountManager/App.pm b/lib/AccountManager/App.pm
index 73be30b..40d504a 100644
--- a/lib/AccountManager/App.pm
+++ b/lib/AccountManager/App.pm
@@ -483,6 +483,7 @@ sub req_complete_challenge {
);
eval {
+ local $ENV{PATH} = '/bin:/sbin:/usr/bin:/usr/sbin';
Email::Sender::Simple->send($message);
};
$self->abort(
--
GitLab