ACL: Disallow '/' characters in queue names specified for "queue="

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 7440a4c06949ec26170789779ba10d66ffb68d34..c06fb9c4fdf5ca73bc1b4aff489b241b66edadf2 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -17136,7 +17136,7 @@ be the name of a file that contains CRLs in PEM format.
 .new
 Under OpenSSL the option can specify a directory with CRL files.
 
 .new
 Under OpenSSL the option can specify a directory with CRL files.
 

-&*Note: Under OpenSSL the option must, if given, supply a CRL
+&*Note:*& Under OpenSSL the option must, if given, supply a CRL

 for each signing element of the certificate chain (i.e. all but the leaf).
 For the file variant this can be multiple PEM blocks in the one file.
 .wen
 for each signing element of the certificate chain (i.e. all but the leaf).
 For the file variant this can be multiple PEM blocks in the one file.
 .wen


@@ -28998,6 +28998,8 @@ effect.
 
 
 .vitem &*queue*&&~=&~<&'text'&>
 
 
 .vitem &*queue*&&~=&~<&'text'&>

+.cindex "&%queue%& ACL modifier"
+.cindex "named queues" "selecting in ACL"

 This modifier specifies the use of a named queue for spool files
 for the message.
 It can only be used before the message is received (i.e. not in
 This modifier specifies the use of a named queue for spool files
 for the message.
 It can only be used before the message is received (i.e. not in

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index d4b1820d5c3b87fefac4c54fa913e051e75c7afd..4897f4a0cc15448d236bf87e3480c6c3d78e3636 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -13,6 +13,9 @@ JH/01 Replace the store_release() internal interface with store_newblock(),
       the allocate and data copy operations duplicated in both (!) of the
       extant use locations.
 
       the allocate and data copy operations duplicated in both (!) of the
       extant use locations.
 

+JH/02 Disallow '/' characters in queue names specified for the "queue=" ACL
+      modifier.  This matches the restriction on the commandline.
+

 Exim version 4.90
 -----------------
 
 Exim version 4.90
 -----------------
 

diff --git a/src/src/acl.c b/src/src/acl.c
index 477b059a59bff98ac68f2d9c0d070f8d7a03a422..b8a4b8865b2a8dd1bedbb11ef0f387de6f6543e5 100644 (file)
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -3597,6 +3597,12 @@ for (; cb != NULL; cb = cb->next)
     #endif
 
     case ACLC_QUEUE:
     #endif
 
     case ACLC_QUEUE:

+    if (Ustrchr(arg, '/'))
+      {
+      *log_msgptr = string_sprintf(
+             "Directory separator not permitted in queue name: '%s'", arg);
+      return ERROR;
+      }

     queue_name = string_copy_malloc(arg);
     break;
 
     queue_name = string_copy_malloc(arg);
     break;