| Subject: | Taint mode not supported |
Hi Josh,
Thanks for maintaining the Authen::Captcha module. It's made my life much easier when my client requested support for captcha images.
I am using taint in my mod_perl applications and had some trouble with your Captcha.pm module. I've attached a patch which works for me. Hope you can find time to include support for taintmode.
Thanks,
William
--- /tmp/Authen-Captcha-1.023/Captcha.pm Wed Dec 17 23:44:34 2003
+++ Captcha.pm Mon Aug 2 15:33:36 2004
@@ -233,7 +233,14 @@
{
$line =~ s/\n//;
my ($data_time,$data_code) = split(/::/,$line);
-
+
+ if ($data_code =~ /^([a-fA-F_0-9]{32})$/) {
+ $data_code = $1;
+ }
+ else {
+ die "Failed to match when attempting to untaint.";
+ }
+
my $png_file = File::Spec->catfile($self->output_folder(),$data_code . ".png");
if ($data_code eq $crypt)
{
@@ -355,6 +362,12 @@
if ( (($current_time - $data_time) > ($self->expire())) ||
($data_code eq $md5) )
{ # remove expired captcha, or a dup
+ if ($data_code =~ /^([a-fA-F_0-9]{32})$/) {
+ $data_code = $1;
+ }
+ else {
+ die "Failed to match when attempting to untaint.";
+ }
my $png_file = File::Spec->catfile($self->output_folder(),$data_code . ".png");
unlink($png_file) or carp("Can't remove png file [$png_file]\n");
} else {