Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 14866 - cvsweb: $ENV{PATH} needs to be specified to allow running with -T (tainting checks)
Summary: cvsweb: $ENV{PATH} needs to be specified to allow running with -T (tainting c...
Status: RESOLVED TEST-REQUEST
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: x86 Linux
: High normal (vote)
Assignee: Rajiv Aaron Manglani (RETIRED)
URL:
Whiteboard:
Keywords: SECURITY
Depends on:
Blocks:
 
Reported: 2003-01-31 13:25 UTC by Bill Burdick Jr.
Modified: 2005-03-20 18:57 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Bill Burdick Jr. 2003-01-31 13:25:13 UTC
User-Agent:       
Build Identifier: 

whenever you goto server.domain.com/cgi-bin/cvsweb.cgi (i.e. you want to view
your repository from the web), you get an Internal server error.  Investigation
of /var/log/apache/error.log leads to the fact that $ENV{PATH} is unclean, so I
fixed it like this.  Perhaps we should have this in cvs web because when I
googled, most people seemed to just want to take the "-T" option of of the
#!/usr/bin/perl line.  Running without tainting checks does _not_ fix the
problem.  Setting the path in the script to something reliable does.


Perhaps the default path should be set in the top of the script i.e.:
.....
require 5.000;

$ENV{PATH} = "/bin:/usr/bin:/usr/local/bin";

use strict;
.....

Reproducible: Always
Steps to Reproduce:
1. emerge cvsweb
2. try to go to server.domain.com/cgi-bin/cvsweb.cgi
3. goto to your http error log
Comment 1 Tom Molesworth 2003-03-10 06:16:36 UTC
this patch worked for me - better IMHO to do this than alter the .cgi file:
(not tested with mod_perl yet)

--- /etc/apache/conf/cvsweb.conf~	2003-03-10 11:04:16.000000000 +0000
+++ /etc/apache/conf/cvsweb.conf	2003-03-10 11:04:34.000000000 +0000
@@ -335,7 +335,7 @@
 
 # remember to set the path to your
 # rcsutils: rlog, rcsdiff (gzip if you use compression)
-#$ENV{'PATH'} = '/usr/local/bin';
+$ENV{'PATH'} = '/bin:/usr/bin:/usr/local/bin';
 
 # If you have files which automatically refers to other files
 # (such as HTML) then this allows you to browse the checked
Comment 2 Andrew Cooks (RETIRED) gentoo-dev 2003-11-29 13:52:31 UTC
This bug has been inactive for more than 180 days.

Can someone look into it?
Comment 3 Renat Lumpau (RETIRED) gentoo-dev 2004-08-25 02:11:38 UTC
please test with the latest cvsweb-3.0.1, now in portage
Comment 4 Rajiv Aaron Manglani (RETIRED) gentoo-dev 2005-03-20 18:57:26 UTC
please test and comment. reopen if still an issue.