FVWM: Security hole in FvwmM4 (?) and Manpage patch for FvwmM4

From: Raymond Toy <toy_at_rtp.ericsson.se>
Date: Wed, 04 Dec 1996 10:43:27 -0500

The manpage doesn't quite format correctly for me (values for the
options don't show up). Appended is a small patch to fix this and a
few other items. (My knowledge of n/troff is very limited, but the
options show up as expected.)

Also, I noticed that m4 is invoked as "m4". Could this be a security
hole? Should the whole path be used by default, say /usr/bin/m4? Of
course this breaks things if /usr/bin/m4 doesn't exist (like
Solaris). However, there's always -m4prog to get the right one.

Ray

*** FvwmM4.man~ Wed May 31 08:09:31 1995
--- FvwmM4.man Wed Dec 4 10:33:37 1996
***************
*** 33,56 ****
  in quotes, and no other quoting should be used. For example, a
  typical invocation might be
  .EX
! fvwm -f "FvwmM4 -m4-squote { -m4-equote } .fvwmrc"
  .EE
  
  Some options can be specified on the command line:
! .IP -m4-prefix
! I think this makes all the m4 directives require the prefix "m4_".
!
! .IP -m4opt \fIoption\fP
! Lets you pass an option to the m4 program.
!
! .IP -m4-squote \fIcharacter\fP
  Lets you change the m4 start-of-quote character to \fIcharacter\fP.
! .IP -m4-equote \fIcharacter\fP
  Lets you change the m4 end-of-quote character to \fIcharacter\fP.
! .IP -m4prog \fIname\fP
  Instead of invoking "m4", fvwm will invoke \fIname\fP.
! .IP -debug
! Causes the temporary file create by m4 to
  be retained. This file is usually called "/tmp/fvwmrcXXXXXX"
  
  
--- 33,62 ----
  in quotes, and no other quoting should be used. For example, a
  typical invocation might be
  .EX
! fvwm -cmd "FvwmM4 -m4-squote { -m4-equote } .fvwmrc"
  .EE
  
  Some options can be specified on the command line:
! .TP
! .BI -m4-prefix ""
! This option tells m4 to prefix all m4 directives with "m4_". However,
! your version of m4 must understand the option "--prefix-builtins".
! GNU m4 understands this.
! .TP
! .BI "-m4opt" " option"
! Lets you pass \fIoption\fP to the m4 program.
! .TP
! .BI "-m4-squote" " character"
  Lets you change the m4 start-of-quote character to \fIcharacter\fP.
! .TP
! .BI "-m4-equote" " character"
  Lets you change the m4 end-of-quote character to \fIcharacter\fP.
! .TP
! .BI "-m4prog" " name"
  Instead of invoking "m4", fvwm will invoke \fIname\fP.
! .TP
! .BI "-debug" ""
! Causes the temporary file created by m4 to
  be retained. This file is usually called "/tmp/fvwmrcXXXXXX"
  
  
***************
*** 69,74 ****
--- 75,82 ----
  The operating system for CLIENTHOST.
  .IP USER
  The name of the person running fvwm.
+ .IP HOME
+ Home directory of the user.
  .IP VERSION
  The X11 version.
  .IP REVISION
***************
*** 90,96 ****
  .IP BITS_PER_RGB
  Number of bits in each rgb triplet.
  .IP CLASS
! The X11 visual class, ie PsuedoColor.
  .IP COLOR
  Yes or No, Yes if the display class is neither StaticGrey or GreyScale.
  .IP FVWM_VERSION
--- 98,104 ----
  .IP BITS_PER_RGB
  Number of bits in each rgb triplet.
  .IP CLASS
! The X11 visual class, i.e. PseudoColor.
  .IP COLOR
  Yes or No, Yes if the display class is neither StaticGrey or GreyScale.
  .IP FVWM_VERSION
***************
*** 130,134 ****
  .EE
  
  .SH AUTHOR
! FvwmM4 is the result of a random bit mutation on a hard disk,
! presumably a result of a cosmic-ray or some such thing.
--- 138,143 ----
  .EE
  
  .SH AUTHOR
! The initial version for Fvwm 1.x was written by Raymond Toy who took
! this almost directly from twm. Robert Nation later converted this to
! a module for Fvwm 2.
--
Visit the official FVWM web page at <URL:http://www.hpc.uh.edu/fvwm/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to majordomo_at_hpc.uh.edu.
To report problems, send mail to fvwm-owner_at_hpc.uh.edu.
Received on Wed Dec 04 1996 - 09:44:23 GMT

This archive was generated by hypermail 2.3.0 : Mon Aug 29 2016 - 19:37:59 BST