[Freeciv-Dev] Re: [Metaserver] scripting security hole (PR#1424)

[Reinier Post <rp@xxxxxxxxxx>]

On Wed, May 01, 2002 at 03:13:05PM -0700, Paul Zastoupil wrote:
> Well considering the metaserver has been waiting to be rewritten for about
> 3 years now.... any volunteers?
> 
> On Wed, May 01, 2002 at 05:53:24PM -0400, Daniel L Speyer wrote:
> > On Wed, 1 May 2002, Paul Zastoupil wrote:
> > 
> > > This is causing the browser to make a request for the file, so you will
> > > only be able to force it to grab files it can already grab.
> > > 
> > > The metaserver shouldn't allow tags, but this isn't a security problem.

We agree that fixing it isn't up to civserver, but to the metaserver,
so I don't think it's release critical.

What civserver should learn is how to send the metaserver info with
HTTP POST, as discussed elsewhere.

-- 
Reinier