The attached patch does three things to the GRAB command:
* If the filename is "-", it outputs the file, encoded using base64, to the
socket. Result code 216 is used.
* Files are restricted to being in "/tmp" and "$VIDEODIR/snaps.dir").
If a full pathname is not given, the default is "$VIDEODIR/snaps.dir".
(This is my previously-existing fix for CAN-2005-0071. It's rolled up into
this patch because it gets reindented; it occupies the section between the
two "we're using a ..." comments.)
* Writing to files is permitted only for connections from localhost since it
is _likely_ that only users on the local machine have access to them.
(This is done entirely in the first patch hunk for svdrp.c.)
It works with 1.3.33 and is cleanly applicable to 1.3.34.
Ideally, cDevice::GrabImage (and methods which override this) would require a
file handle instead of a filename. This change would require that some
plugins (vdr-xine, for one) also be patched, so I've not done this - yet.
--
| Darren Salt | d youmustbejoking,demon,co,uk | nr. Ashington,
| Debian, | s zap,tartarus,org | Northumberland
| RISC OS | @ | Toon Army
| <URL:http://www.youmustbejoking.demon.co.uk/progs.packages.html>
There is no time like the present to postpone what you ought to be doing.