From d414962af452efd08e63b22cdaf532fff4f932d1 Mon Sep 17 00:00:00 2001 From: Wayne Davison Date: Thu, 12 Aug 2004 21:02:13 +0000 Subject: [PATCH] One more NEWS tweak. --- NEWS | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/NEWS b/NEWS index 290c72d8..305e10d8 100644 --- a/NEWS +++ b/NEWS @@ -5,10 +5,11 @@ Changes since 2.6.2: SECURITY FIXES: - A bug in the sanitize_path routine (which affects a non-chrooted - rsync daemon) could allow a user to specify an absolute path for - certain options (but not for file-transfer names). If you're running - a rsync daemon with chroot disabled, *please upgrade*, ESPECIALLY if - the user privs you run rsync under is anything above "nobody". + rsync daemon) could allow a user to craft a pathname that would get + transformed into an absolute path for certain options (but not for + file-transfer names). If you're running a rsync daemon with chroot + disabled, *please upgrade*, ESPECIALLY if the user privs you run + rsync under is anything above "nobody". OUTPUT CHANGES (ATTN: those using a script to parse the verbose output): -- 2.34.1