diff options
| author | Phil Pennock <pdp@exim.org> | 2017-05-09 16:00:58 -0400 |
|---|---|---|
| committer | Phil Pennock <pdp@exim.org> | 2017-05-09 16:00:58 -0400 |
| commit | f33875c3a0a0ef03a2e53cfcd339791b793151f0 (patch) | |
| tree | 109391b7ca17bfab48708c1c09ccc4b9502df204 /doc/doc-txt/ChangeLog | |
| parent | ce889807c90746896f1310e9f4957215f46f7836 (diff) | |
Add option commandline_checks_require_admin
May help with scenarios already so broken that bug report 2118 is
actually an issue (Wordpress vuln).
Diffstat (limited to 'doc/doc-txt/ChangeLog')
| -rw-r--r-- | doc/doc-txt/ChangeLog | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 2078b3521..4bc5235ec 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -78,6 +78,14 @@ JH/12 Fix check on SMTP command input synchronisation. Previously there were or prompt from Exim (running as a server), due to that code's lack of awareness of the SMTP input buferring. +PP/04 Add commandline_checks_require_admin option. + Exim drops privileges sanely, various checks such as -be aren't a + security problem, as long as you trust local users with access to their + own account. When invoked by services which pass untrusted data to + Exim, this might be an issue. Set this option in main configuration + AND make fixes to the calling application, such as using `--` to stop + processing options. + Exim version 4.89 ----------------- |