Re: MP1 Security issue (was Re: [mp1] PerlRun fails if path_info contains special symbols)

[Fred Moyer <suppressed>]

Philip M. Gollucci wrote:
> Perrin Harkins wrote:
> > On 3/22/07, Andy Armstrong <suppressed> wrote:
> > >       $path_info = quotemeta $path_info;
> > >       my $script_name = $path_info && $self->{URI} =~ /$path_info$/
> >
> > You can in-line that to avoid clobbering the original:
> > my $script_name = $path_info && $self->{URI} =~ /\Q$path_info\E$/
> +1 from me.
>
> I guess we should start planning for a 1.30 and 2.0.4 once this is 
> agreed and committed ?

The changes are ready for review on the dev list.  I can dig up some 
tuits to help with the release if needed, and I think we are pretty set 
there patch wise for anyone who needs something right away.

Now I guess we just need that press release... Randal maybe you can get 
this all out on Perlcast? :)