From cff93397ab185898fd93b6a260cc6f3068c4ac30 Mon Sep 17 00:00:00 2001 From: "Shawn O. Pearce" Date: Sat, 8 Sep 2007 23:47:00 -0400 Subject: [PATCH] git-gui: Disable Tk send in all git-gui sessions The Tk designers blessed us with the "send" command, which on X11 will allow anyone who can connect to your X server to evaluate any Tcl code they desire within any running Tk process. This is just plain nuts. If git-gui wants someone running Tcl code within it then would ask someone to supply that Tcl code to it; waiting for someone to drop any random Tcl code into us is not fantastic idea. By renaming send to the empty name the procedure will be removed from the global namespace and Tk will stop responding to random Tcl evaluation requests sent through the X server. Since there is no facility to filter these requests it is unlikely that we will ever consider enabling this command. Signed-off-by: Shawn O. Pearce --- git-gui.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/git-gui.sh b/git-gui.sh index 44977aa..6d67609 100755 --- a/git-gui.sh +++ b/git-gui.sh @@ -42,6 +42,8 @@ if {[catch {package require Tcl 8.4} err] exit 1 } +rename send {} ; # What an evil concept... + ###################################################################### ## ## enable verbose loading? -- 2.11.4.GIT