diff options
| author | low012 <low012@6c8d7289-2bf4-0310-a012-ef5d649a1542> | 2009-10-17 00:26:14 +0000 |
|---|---|---|
| committer | low012 <low012@6c8d7289-2bf4-0310-a012-ef5d649a1542> | 2009-10-17 00:26:14 +0000 |
| commit | f5656b2ae1dbec6b3f19509aa15aa3b3093c7b45 (patch) | |
| tree | 99cebb1e65c54e87b6473534479bb5d6c313429f /htroot/ConfigLanguage_p.html | |
| parent | 3434ca381fd206b0ae65ff2f750aeeed8ea513d9 (diff) | |
*) Made sure that only files with appropriate file endings are listed as skin or language files.
*) Introduced protection against directory traversal attacks in configuration servlets for skin and language configuration. Files can only be deleted if they are contained in a list of files which has been read by the servlet first.
Until now it was possible to delete any data on a system YaCy is running on and which can be deleted by the user who's account has been used to start YaCy. Most of the times a user of YaCy is also the owner of the machine the peer is running on, but this might not always be the case and not even the owner of the machine should be able to use YaCy as a replacement for "rm" or "del".
git-svn-id: https://svn.berlios.de/svnroot/repos/yacy/trunk@6423 6c8d7289-2bf4-0310-a012-ef5d649a1542
Diffstat (limited to 'htroot/ConfigLanguage_p.html')
| -rw-r--r-- | htroot/ConfigLanguage_p.html | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/htroot/ConfigLanguage_p.html b/htroot/ConfigLanguage_p.html index 4f2aa39c7..29192d109 100644 --- a/htroot/ConfigLanguage_p.html +++ b/htroot/ConfigLanguage_p.html @@ -51,6 +51,8 @@ </dd>
<dd><input type="submit" value="Install" /></dd>
</dl>
+ <p>Make sure that you only download data from trustworthy sources. The new language file
+ might overwrite existing data if a file of the same name exists already.</p>
</fieldset>
</form>
#(status)#
|