Taint: fix multiple ACL actions to properly manage tainted argument data

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index d33685033962ce81c082cdc3ddca7a73105e0efe..96d477df383ab0c7097eadc4c8bb708dc8ddb108 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -8038,8 +8038,8 @@ For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterB
 it is possible to specify a list of servers with an individual query. This is
 done by appending a comma-separated option to the query type:
 .display
-.endd
 &`,servers=`&&'server1:server2:server3:...'&
+.endd
 .wen
 Each item in the list may take one of two forms:
 .olist
@@ -10170,6 +10170,18 @@ extracted is used.
 You can use &`fail`& instead of {<&'string3'&>} as in a string extract.
 
 
+.new
+.vitem &*${listquote{*&<&'separator'&>&*}{*&<&'string'&>&*}}*&
+.cindex quoting "for list"
+.cindex list quoting
+This item doubles any occurrence of the separator character
+in the given string.
+An empty string is replaced with a single space.
+This converts the string into a safe form for use as a list element,
+in a list using the given separator.
+.wen
+
+
 .vitem "&*${lookup{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
         {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
 This is the first of one of two different types of lookup item, which are both
@@ -11922,15 +11934,12 @@ request, for a password, so the data consists of just two strings.
 
 There can be problems if any of the strings are permitted to contain colon
 characters. In the usual way, these have to be doubled to avoid being taken as
-separators. If the data is being inserted from a variable, the &%sg%& expansion
-item can be used to double any existing colons. For example, the configuration
+separators.
+The &%listquote%& expansion item can be used for this.
+For example, the configuration
 of a LOGIN authenticator might contain this setting:
 .code
-server_condition = ${if pam{$auth1:${sg{$auth2}{:}{::}}}}
-.endd
-For a PLAIN authenticator you could use:
-.code
-server_condition = ${if pam{$auth2:${sg{$auth3}{:}{::}}}}
+server_condition = ${if pam{$auth1:${listquote{:}{$auth2}}}}
 .endd
 In some operating systems, PAM authentication can be done only from a process
 running as root. Since Exim is running as the Exim user when receiving
@@ -17800,9 +17809,9 @@ The capitalized placeholders do proper URL encoding, if you use them
 lowercased, no encoding takes place.  This list was compiled from the
 libspf2 sources.
 
-A note on using Exim variables: As currenty the SPF library is initialized
-already during the EHLO phase, the amount of variables available for
-expansion is quite limited.
+A note on using Exim variables: As
+currently the SPF library is initialized before the SMTP EHLO phase,
+the variables useful for expansion are quite limited.
 .wen