[patch] This patch updates a few default settings to more reasonable values. Additionally prevents unpriviledged users from editing ClientNameAlias, fixing security issue CVE-2009-3369.

03-reasonable-config.pl-defaults.patch (text/plain), 912 bytes, created by Lenno Nagel on 2009-09-30 22:52:45 UTC

--- conf/config.pl.formatted	2009-09-30 14:30:54.035496661 +0300
+++ conf/config.pl	2009-10-01 01:46:40.409574184 +0300
@@ -1917,7 +1917,7 @@
 #    --> administrative users are only craig and celia'.
 #
 $Conf{CgiAdminUserGroup} = '';
-$Conf{CgiAdminUsers}     = '';
+$Conf{CgiAdminUsers}     = 'backuppc';
 
 #
 # URL of the BackupPC_Admin CGI script.  Used for email messages.
@@ -1964,7 +1964,7 @@
 # dates (MM/DD), a value of 2 uses full YYYY-MM-DD format, and zero
 # for international dates (DD/MM).
 #
-$Conf{CgiDateFormatMMDD} = 1;
+$Conf{CgiDateFormatMMDD} = 2;
 
 #
 # If set, the complete list of hosts appears in the left navigation
@@ -2138,7 +2138,7 @@
   'EMailNotifyMinDays' => '1',
   'RsyncdAuthRequired' => '1',
   'SmbClientRestoreCmd' => '0',
-  'ClientNameAlias' => '1',
+  'ClientNameAlias' => '0',
   'DumpPostShareCmd' => '0',
   'IncrLevels' => '1',
   'EMailOutlookBackupMesg' => '1',