| Improved patch to fix CVE 2007-5837 - remote code injection. |
| See Gentoo bug #197660 and #378413. |
| |
| --- yarssr-0.2.2/lib/Yarssr/GUI.pm |
| +++ yarssr-0.2.2/lib/Yarssr/GUI.pm |
| @@ -163,8 +163,15 @@ |
| } |
| else { |
| my $b = Yarssr::Config->get_browser; |
| - $b .= " \"$url\"" unless $b =~ s/\%s/"$url"/; |
| - exec($b) or warn "unable to launch browser\n"; |
| + my @b = split(' ', Yarssr::Config->get_browser); |
| + if (grep(/\%s/, @b)) |
| + { |
| + map {grep(s/\%s/$url/, $_) => $_} @b; |
| + } |
| + else { |
| + push(@b, $url); |
| + } |
| + exec(@b) or warn "unable to launch browser\n"; |
| exit; |
| } |
| } |
