diff options
| author | wm4 <wm4@nowhere> | 2014-09-16 18:23:01 +0200 |
|---|---|---|
| committer | Alessandro Ghedini <alessandro@ghedini.me> | 2014-09-23 21:08:54 +0200 |
| commit | 6f7f7c3e2eb0788238d2c397e9c63a63c271540c (patch) | |
| tree | 68c1064c06a1afbde9da584260439b7491e5a980 /VERSION | |
| parent | 5b6a67bf76a9d8b0a7e79340043dc4369ecbdb72 (diff) | |
| download | mpv-6f7f7c3e2eb0788238d2c397e9c63a63c271540c.tar.bz2 mpv-6f7f7c3e2eb0788238d2c397e9c63a63c271540c.tar.xz | |
player: don't let multiline filenames set options on resume
If --write-filename-in-watch-later-config is used, and the filename
contains newline characters (as generally allowed on Unix), then the
newline will be written to the resume file literally, and the parts
after the newline character are interpreted as options.
This is possibly security relevant.
Change newline characters (and in fact any other special characters)
to '_'.
Reported as #1099 (this commit is a reimplementation of the proposed
pull request).
CC: @mpv-player/stable
Diffstat (limited to 'VERSION')
0 files changed, 0 insertions, 0 deletions