Taint: fix multiple ACL actions to properly manage tainted argument data

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 4147ee205179977af26d09f9162eb9e1bb15e487..96d477df383ab0c7097eadc4c8bb708dc8ddb108 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -8038,8 +8038,8 @@ For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterB
 it is possible to specify a list of servers with an individual query. This is
 done by appending a comma-separated option to the query type:
 .display
 it is possible to specify a list of servers with an individual query. This is
 done by appending a comma-separated option to the query type:
 .display

-.endd

 &`,servers=`&&'server1:server2:server3:...'&
 &`,servers=`&&'server1:server2:server3:...'&

+.endd

 .wen
 Each item in the list may take one of two forms:
 .olist
 .wen
 Each item in the list may take one of two forms:
 .olist


@@ -10170,6 +10170,18 @@ extracted is used.
 You can use &`fail`& instead of {<&'string3'&>} as in a string extract.
 
 
 You can use &`fail`& instead of {<&'string3'&>} as in a string extract.
 
 

+.new
+.vitem &*${listquote{*&<&'separator'&>&*}{*&<&'string'&>&*}}*&
+.cindex quoting "for list"
+.cindex list quoting
+This item doubles any occurrence of the separator character
+in the given string.
+An empty string is replaced with a single space.
+This converts the string into a safe form for use as a list element,
+in a list using the given separator.
+.wen
+
+

 .vitem "&*${lookup{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
         {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
 This is the first of one of two different types of lookup item, which are both
 .vitem "&*${lookup{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
         {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
 This is the first of one of two different types of lookup item, which are both


@@ -11922,15 +11934,12 @@ request, for a password, so the data consists of just two strings.
 
 There can be problems if any of the strings are permitted to contain colon
 characters. In the usual way, these have to be doubled to avoid being taken as
 
 There can be problems if any of the strings are permitted to contain colon
 characters. In the usual way, these have to be doubled to avoid being taken as

-separators. If the data is being inserted from a variable, the &%sg%& expansion
-item can be used to double any existing colons. For example, the configuration
+separators.
+The &%listquote%& expansion item can be used for this.
+For example, the configuration

 of a LOGIN authenticator might contain this setting:
 .code
 of a LOGIN authenticator might contain this setting:
 .code

-server_condition = ${if pam{$auth1:${sg{$auth2}{:}{::}}}}
-.endd
-For a PLAIN authenticator you could use:
-.code
-server_condition = ${if pam{$auth2:${sg{$auth3}{:}{::}}}}
+server_condition = ${if pam{$auth1:${listquote{:}{$auth2}}}}

 .endd
 In some operating systems, PAM authentication can be done only from a process
 running as root. Since Exim is running as the Exim user when receiving
 .endd
 In some operating systems, PAM authentication can be done only from a process
 running as root. Since Exim is running as the Exim user when receiving


@@ -14578,6 +14587,7 @@ listed in more than one group.
 .row &%percent_hack_domains%&        "recognize %-hack for these domains"
 .row &%spamd_address%&               "set interface to SpamAssassin"
 .row &%strict_acl_vars%&             "object to unset ACL variables"
 .row &%percent_hack_domains%&        "recognize %-hack for these domains"
 .row &%spamd_address%&               "set interface to SpamAssassin"
 .row &%strict_acl_vars%&             "object to unset ACL variables"

+.row &%spf_smtp_comment_template%&   "template for &$spf_smtp_comment$&"

 .endtable
 
 
 .endtable
 
 


@@ -17761,6 +17771,48 @@ See section &<<SECTscanspamass>>& for more details.
 This option is available when Exim is compiled with SPF support.
 See section &<<SECSPF>>& for more details.
 
 This option is available when Exim is compiled with SPF support.
 See section &<<SECSPF>>& for more details.
 

+.new
+.option spf_smtp_comment_template main string&!! "Please%_see%_http://www.open-spf.org/Why"
+This option is available when Exim is compiled with SPF support.  It
+allows the customisation of the SMTP comment that the SPF library
+generates.  You are strongly encouraged to link to your own explanative
+site. The template must not contain spaces. If you need spaces in the
+output, use the proper placeholder. If libspf2 can not parse the
+template, it uses a built-in default broken link. The following placeholders
+(along with Exim variables (but see below)) are allowed in the template:
+.ilist
+&*%_*&: A space.
+.next
+&*%{L}*&: Envelope sender's local part.
+.next
+&*%{S}*&: Envelope sender.
+.next
+&*%{O}*&: Envelope sender's domain.
+.next
+&*%{D}*&: Current(?) domain.
+.next
+&*%{I}*&: SMTP client Ip.
+.next
+&*%{C}*&: SMTP client pretty IP.
+.next
+&*%{T}*&: Epoch time (UTC).
+.next
+&*%{P}*&: SMTP client domain name.
+.next
+&*%{V}*&: IP version.
+.next
+&*%{H}*&: EHLO/HELO domain.
+.next
+&*%{R}*&: Receiving domain.
+.endlist
+The capitalized placeholders do proper URL encoding, if you use them
+lowercased, no encoding takes place.  This list was compiled from the
+libspf2 sources.
+
+A note on using Exim variables: As
+currently the SPF library is initialized before the SMTP EHLO phase,
+the variables useful for expansion are quite limited.
+.wen

 
 
 .option split_spool_directory main boolean false
 
 
 .option split_spool_directory main boolean false


@@ -41044,8 +41096,13 @@ variables:
 
 .vitem &$spf_smtp_comment$&
 .vindex &$spf_smtp_comment$&
 
 .vitem &$spf_smtp_comment$&
 .vindex &$spf_smtp_comment$&

+.vindex &%spf_smtp_comment_template%&

   This contains a string that can be used in a SMTP response
   to the calling party. Useful for "fail".
   This contains a string that can be used in a SMTP response
   to the calling party. Useful for "fail".

+.new
+  The string is generated by the SPF library from the template configured in the main config
+  option &%spf_smtp_comment_template%&.
+.wen

 .endlist
 
 
 .endlist