(no commit message)

diff --git a/doc/bugs/ikiwiki_ignores_PATH_environment.mdwn b/doc/bugs/ikiwiki_ignores_PATH_environment.mdwn
index 5097acaef5c2de5fe74208ee8436f59f2a282351..992ea0a2a879ae66445f4eddd46501019eccbb14 100644 (file)
--- a/doc/bugs/ikiwiki_ignores_PATH_environment.mdwn
+++ b/doc/bugs/ikiwiki_ignores_PATH_environment.mdwn
@@ -16,3 +16,5 @@ This makes it a little hard to specify which specific binaries should be used, e
 > The ikiwiki script's own sanitization of PATH was done to make perl taint
 > checking happy, but as taint checking is disabled anyway, I have removed
 > that. [[done]] --[[Joey]] 
 > The ikiwiki script's own sanitization of PATH was done to make perl taint
 > checking happy, but as taint checking is disabled anyway, I have removed
 > that. [[done]] --[[Joey]] 

+
+Question: Do ikiwiki.cgi and the RCS post-commit script sanitize the $PATH separately from bin/ikiwiki?  If not, then bin/ikiwiki is probably right to sanitize the $PATH; otherwise you've created a security hole with access to the account that ikiwiki is SUID to. It'd be nice if /opt/local/bin were earlier in the $PATH, but that can be changed (as noted) in the setup file. [[Glenn|geychaner@mac.com]]