From e2bd7e7a1f995c385f1657db7086cf88089e8a64 Mon Sep 17 00:00:00 2001
From: Tom Knight <tomk@gentoo.org>
Date: Sun, 19 Aug 2007 20:32:39 +0000
Subject: Prevent command execution vulnerabilities, bug 187971

---
 src/packages/mksite.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/packages/mksite.py b/src/packages/mksite.py
index 9849b1be1e..7e3561bb70 100644
--- a/src/packages/mksite.py
+++ b/src/packages/mksite.py
@@ -155,7 +155,7 @@ def main():
     open(config.LOCALHOME + '/ebuilds/index.shtml', 'w').write(
             index.replace(
                 '<!--#include virtual="main.shtml"-->',
-                '<!--#exec cmd="./query_ebuild.py $QUERY_STRING" -->')
+                '<!--#exec cmd="export QUERY_STRING;./query_ebuild.py" -->')
             )
 
     # /feeds
@@ -190,7 +190,7 @@ def main():
     # /search
     open(config.LOCALHOME + '/search/index.shtml', 'w').write(
             index.replace('<!--#include virtual="main.shtml"-->',
-                '<!--#exec cmd="./search.py $QUERY_STRING" -->'
+                '<!--#exec cmd="export QUERY_STRING;./search.py" -->'
                 )
             )
 
@@ -202,7 +202,7 @@ def main():
     # /similar
     open(config.LOCALHOME + '/similar/index.shtml', 'w').write(
             index.replace('<!--#include virtual="main.shtml"-->',
-                '<!--#exec cmd="./similar.py $QUERY_STRING" -->'
+                '<!--#exec cmd="export QUERY_STRING;./similar.py" -->'
                 )
             )
 
-- 
cgit v1.2.3-65-gdbad