Place this file in the src/ inside the Dancer directory and run this command: $ patch < exec_patch-1.txt Now rebuild Dancer. Index: transfer.c =================================================================== RCS file: /cvsroot/dancer/dancer/src/transfer.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- transfer.c 26 Jun 2001 00:02:39 -0000 1.2 +++ transfer.c 5 Feb 2002 04:00:50 -0000 1.3 @@ -401,6 +401,11 @@ * Note: if user input isn't quoted they can * access ';', '&', '|' and '^' special * characters. + * Note: quoting does not protect against + * $(command) in userinput, so '$' is + * also checked as a workaround. + * As a real solution, Exec() should be + * fixed to not use popen(). */ va_start(args, format); for (pointer = format; *pointer; pointer++) { @@ -420,13 +425,11 @@ case '"': case '`': -#if 0 case ';': case '&': case '|': case '^': -#endif - + case '$': wrong = TRUE; break; Index: version.h =================================================================== RCS file: /cvsroot/dancer/dancer/src/version.h,v retrieving revision 1.2 diff -u -r1.2 version.h --- version.h 10 Mar 2001 21:07:31 -0000 1.2 +++ version.h 8 Feb 2002 02:56:24 -0000 @@ -1,4 +1,4 @@ #ifndef VERSION_H #define VERSION_H -#define VERSION "4.16" +#define VERSION "4.16p1" #endif /* VERSION_H */