(originally sent to feedback@...)
> We are attempting to use ScrumWiki for our project. We're
> on a Win2K platform using Apache 2.0. When we try to save
> our first page, we get a Perl error "Insecure dependency in
> open while running with -T switch."

This is perl enabling taint mode checking [1], which on the whole is a
very good idea. Thanks for reporting this.

You may be able to resolve it by disabling taint checking in your
apache conf, but this a bit like leaving your front door unlocked
because you cannot find your keys. Plus, I suspect it is the perl CGI
module that is enabling it.

To fix it in the code, see changes below. I'll roll these into the
next release whenever I get the time to do it.

You might hit some other similar problems with taint checking on, but
the 2 changes below got me a working version with taint checking
turned on. Let me know if you hit other problems.

Murray.


----


replace this (around line 3870)

sub WriteStringToFile {
my ($file, $string) = @_;

open (OUT, ">$file") or die(Ts('cant write %s', $file) . ": $!");
print OUT $string;
close(OUT);
}

sub AppendStringToFile {
my ($file, $string) = @_;

open (OUT, ">>$file") or die(Ts('cant write %s', $file) . ": $!");

with this:

sub WriteStringToFile {
my ($file, $string) = @_;

my $safe;
if ($file =~ /^([\w\d\\\/\.\_\-\(\)]+)$/) { $safe = $1; }
else { die("possibly un safe (tainted) file name"); }

open (OUT, ">$safe") or die(Ts('cant write %s', $safe) . ": $!");
print OUT $string;
close(OUT);
}

sub AppendStringToFile {
my ($file, $string) = @_;

my $safe;
if ($file =~ /^([\w\d\\\/\.\_\-\(\)]+)$/) { $safe = $1; }
else { die("possibly un safe (tainted) file name"); }

open (OUT, ">>$safe") or die(Ts('cant write %s', $safe) . ": $!");

and also replace this (around line 6976)

open(OUT, ">$file") or die("while trying to save $file $!");
binmode OUT;
if ($imgType eq 'gif') { print(OUT $im->gif); }
else { print(OUT $im->png); }
close(OUT);
$file .= '.small.' . $imgType;
open(OUT, ">$file") or die("while trying to save $file $!");

with this

my $safe;
if ($file =~ /^([\w\d\\\/\.\_\-\(\)]+)$/) { $safe = $1; }
else {
die("possibly un safe (tainted) file name");
}
open(OUT, ">$safe") or die("while trying to save $safe $!");
binmode OUT;
if ($imgType eq 'gif') { print(OUT $im->gif); }
else { print(OUT $im->png); }
close(OUT);
$safe .= '.small.' . $imgType;
open(OUT, ">$safe") or die("while trying to save $safe $!");