The attached patch does three things to the GRAB command:

* If the filename is "-", it outputs the file, encoded using base64, to the socket. Result code 216 is used.

* Files are restricted to being in "/tmp" and "$VIDEODIR/snaps.dir"). If a full pathname is not given, the default is "$VIDEODIR/snaps.dir". (This is my previously-existing fix for CAN-2005-0071. It's rolled up into this patch because it gets reindented; it occupies the section between the two "we're using a ..." comments.)

* Writing to files is permitted only for connections from localhost since it is _likely_ that only users on the local machine have access to them. (This is done entirely in the first patch hunk for svdrp.c.)

It works with 1.3.33 and is cleanly applicable to 1.3.34.

Ideally, cDevice::GrabImage (and methods which override this) would require a file handle instead of a filename. This change would require that some plugins (vdr-xine, for one) also be patched, so I've not done this - yet.