ACL: Disallow '/' characters in queue names specified for "queue="

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 7440a4c06949ec26170789779ba10d66ffb68d34..c06fb9c4fdf5ca73bc1b4aff489b241b66edadf2 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -17136,7 +17136,7 @@ be the name of a file that contains CRLs in PEM format.
 .new
 Under OpenSSL the option can specify a directory with CRL files.
 
-&*Note: Under OpenSSL the option must, if given, supply a CRL
+&*Note:*& Under OpenSSL the option must, if given, supply a CRL
 for each signing element of the certificate chain (i.e. all but the leaf).
 For the file variant this can be multiple PEM blocks in the one file.
 .wen
@@ -28998,6 +28998,8 @@ effect.
 
 
 .vitem &*queue*&&~=&~<&'text'&>
+.cindex "&%queue%& ACL modifier"
+.cindex "named queues" "selecting in ACL"
 This modifier specifies the use of a named queue for spool files
 for the message.
 It can only be used before the message is received (i.e. not in

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index d4b1820d5c3b87fefac4c54fa913e051e75c7afd..4897f4a0cc15448d236bf87e3480c6c3d78e3636 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -13,6 +13,9 @@ JH/01 Replace the store_release() internal interface with store_newblock(),
       the allocate and data copy operations duplicated in both (!) of the
       extant use locations.
 
+JH/02 Disallow '/' characters in queue names specified for the "queue=" ACL
+      modifier.  This matches the restriction on the commandline.
+
 Exim version 4.90
 -----------------
 

diff --git a/src/src/acl.c b/src/src/acl.c
index 477b059a59bff98ac68f2d9c0d070f8d7a03a422..b8a4b8865b2a8dd1bedbb11ef0f387de6f6543e5 100644 (file)
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -3597,6 +3597,12 @@ for (; cb != NULL; cb = cb->next)
     #endif
 
     case ACLC_QUEUE:
+    if (Ustrchr(arg, '/'))
+      {
+      *log_msgptr = string_sprintf(
+             "Directory separator not permitted in queue name: '%s'", arg);
+      return ERROR;
+      }
     queue_name = string_copy_malloc(arg);
     break;