This is a multi-part message in MIME format.
--------------B4F2E0599FAFA391B3E4117D
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
 
The INCLUDE function of the TWiki Collaboration Platform 
allows arbitrary shell command execution. The permanent 
place for this advisory is 
http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithInclude
where updates will be posted.
 
 
---++ Vulnerable Software Version
 
   * TWiki Release 03-Sep-2004[2] -- TWiki20040903.zip
   * TWiki Release 02-Sep-2004[3] -- TWiki20040902.zip
   * TWiki Release 01-Sep-2004[4] -- TWiki20040901.zip
   * TWiki Release 01-Feb-2003[5] -- TWiki20030201.zip
 
Not affected are:
 
   * Recent DakarReleases[6] (upcoming production release, soon)
   * TWiki Release 01 Sep 2004 patched with Florian Weimer's 
     UncoordinatedSecurityAlert23Feb2005[7]
 
 
---++ Attack Vectors
 
Editing wiki pages and HTTP GET requests towards the Wiki server 
(typically port 80/TCP). Typically, prior authentication is 
necessary (including anonymous TWikiGuest accounts).
 
 
---++ Impact
 
An attacker is able to execute arbitrary shell commands with the
privileges of the web server process, such as user nobody.
 
 
---++ MITRE Name for this Vulnerability
 
The Common Vulnerabilities and Exposures project has assigned the 
name CAN-2005-3056 to this vulnerability. 
 
 
---++ Details
 
The TWiki INCLUDE function enables a malicious user to compose a 
command line executed by the Perl backtick (``) operator.
 
The rev parameter of the INCLUDE variable is not checked properly 
for shell metacharacters and is thus vulnerable to revision 
numbers containing pipes and shell commands. The exploit is 
possible on included topics with two or more revisions.
 
Example INCLUDE variable exploiting the rev parameter:
%INCLUDE{ "Main.TWikiUsers" rev="2|less /etc/passwd" }%
 
The same vulnerability is exposed to all Plugins and add-ons that 
use TWiki::Func::readTopicText[8] function to read a previous topic 
revision. This has been tested on TWiki:Plugins.RevCommentPlugin[9] 
and TWiki:Plugins.CompareRevisionsAddon[10].
 
If access to TWiki is not restricted by other means, attackers can
use the revision function with or without prior authentication,
depending on the configuration.
 
See Also:
   * IncludePreviousTopicRevision[11]
   * SecurityAlertExecuteCommandsWithRev[12]
   * SecurityAlertExecuteCommandsWithSearch[13]
   * UncoordinatedSecurityAlert23Feb2005[7]
 
 
---++ Countermeasures
 
   * Apply hotfix (see patches below)
      * NOTE: The hotfix is known to prevent the current attacks,  
        but it might not be a complete fix
   * Upgrade to the latest patched production TWikiRelease04Sep2004[1]
      * NOTE: If you are running an *unmodified* 
        TWikiRelease01Sep2004[4], TWikiRelease02Sep2004[3] or
        TWikiRelease03Sep2004[2], simply copy the following patched
        files from TWikiRelease04Sep2004 to your installation:
        lib/TWiki.pm, lib/TWiki/Store.pm, lib/TWiki/UI/RDiff.pm,
        lib/TWiki/UI/View.pm, lib/TWiki/UI/Viewfile.pm
   * Apply patch of UncoordinatedSecurityAlert23Feb2005[7] (but see
     known issues of that patch)
   * Filter access to the web server
   * Use the web server software to restrict access to the web pages
     served by TWiki
 
---++ Authors and Credits
 
   * Credit to TWiki:Main.JChristophFuchs (jcf@ipp.mpg.de) and 
     TWiki:Main.JoseLuna (luna@aditel.org) for disclosing the issue
     to the twiki-security@lists.sourceforge.net mailing list
   * TWiki:Main.JoseLuna for contributing a more robust patch to
     recent SecurityAlertExecuteCommandsWithRev[12] issue (included
     in this patch)
   * TWiki:Main.PeterThoeny, TWiki:Main.JoseLuna, 
     TWiki:Main.CrawfordCurrie for contributing to the advisory and
     the patch
 
 
---++ Hotfix
 
---+++ Patch for TWiki Production Release 03-Sep-2004
 
Affected files: twiki/lib/TWiki.pm, twiki/lib/TWiki/Store.pm,
lib/TWiki/UI/RDiff.pm, lib/TWiki/UI/View.pm,
lib/TWiki/UI/Viewfile.pm
 
See attached patch file TWiki200409-03-04patch.txt
 
 
---+++ Patch for TWiki Production Release 02-Sep-2004
 
Affected files: twiki/lib/TWiki.pm, twiki/lib/TWiki/Store.pm,
lib/TWiki/UI/RDiff.pm, lib/TWiki/UI/View.pm,
lib/TWiki/UI/Viewfile.pm
 
See attached patch file TWiki200409-02-04patch.txt
 
 
---+++ Patch for TWiki Production Release 01-Feb-2003
 
__Note:__ This assumes that the release is already patched with 
SecurityAlertExecuteCommandsWithRev[12] fix.
 
Affected files: twiki/lib/TWiki/Store.pm, twiki/bin/rdiff,
twiki/bin/view, twiki/bin/viewfil=
 
See attached patch file TWiki200302-01-04patch.txt
 
 
---++ About TWiki
 
TWiki, a flexible, powerful, and easy to use enterprise 
collaboration platform. It is a Structured Wiki, typically 
used to run a project development space, a document 
management system, a knowledge base, or any other groupware 
tool, on an intranet or on the internet. Web content can be 
created collaboratively by using just a browser. Users without 
programming skills can create web applications. Developers can 
extend the functionality of TWiki with Plugins. 
 
 
Best regards,
Peter
 
 
[1]:  http://twiki.org/cgi-bin/view/Codev/TWikiRelease04Sep2004
[2]:  http://twiki.org/cgi-bin/view/Codev/TWikiRelease03Sep2004
[3]:  http://twiki.org/cgi-bin/view/Codev/TWikiRelease02Sep2004
[4]:  http://twiki.org/cgi-bin/view/Codev/TWikiRelease01Sep2004
[5]:  http://twiki.org/cgi-bin/view/Codev/TWikiRelease01Feb2003
[6]:  http://twiki.org/cgi-bin/view/Codev/DakarReleases
[7]:  http://twiki.org/cgi-bin/view/Codev/UncoordinatedSecurityAlert23Feb2005
[8]:  http://twiki.org/cgi-bin/view/TWiki/TWikiFuncModule
[9]:  http://twiki.org/cgi-bin/view/Plugins/RevCommentPlugin
[10]: http://twiki.org/cgi-bin/view/Plugins/CompareRevisionsAddon
[11]: http://twiki.org/cgi-bin/view/Codev/IncludePreviousTopicRevision
[12]: http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
[13]: http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch
 
 
--
   * Peter Thoeny                           Peter@Thoeny.com
   * Is your team already TWiki enabled?    http://TWiki.org
   * This e-mail is:  (x) public  (_) ask first  (_) private
--------------B4F2E0599FAFA391B3E4117D
Content-Type: text/plain; charset=us-ascii;
 name="TWiki200409-03-04patch.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="TWiki200409-03-04patch.txt"
 
--- ../rel20040903/TWikiDocumentation.html     Fri Sep  9 18:09:15 2005
+++ ./TWikiDocumentation.html   Tue Sep 20 16:32:36 2005
@@ -1,7 +1,7 @@
 <html><head>
 <title>TWikiDocumentation</title>
 </head><body bgcolor="#ffffff">
-<h1><a name="TWiki_Reference_Manual_03_Sep_20"> </a><a name="_TW
iki_Reference_Manual_03_Sep_2"> </a>  TWiki Reference Manual (03 Sep 2004 $Rev: 1742 $)
 </h1>
+<h1><a name="TWiki_Reference_Manual_04_Sep_20"> </a><a name="_TW
iki_Reference_Manual_04_Sep_2"> </a>  TWiki Reference Manual (04 Sep 2004 $Rev: 1742 $)
 </h1>
 <p />
 <script type="text/javascript">
 <!--
@@ -3816,7 +3816,7 @@
 </li>
 </ul>
 <p />
-This version of TWiki - 03 Sep 2004 $Rev: 1742 $ - expands the following variables (enclosed in <
code><b>%</b></code> percent signs):
+This version of TWiki - 04 Sep 2004 $Rev: 1742 $ - expands the following variables (enclosed in <
code><b>%</b></code> percent signs):
 <p />
 <p />
 <p />
@@ -4627,7 +4627,7 @@
 <ul>
 <li> Syntax: <code>%WIKIVERSION%</code>
 </li>
-<li> Expands to: <code>03 Sep 2004 $Rev: 1742 $</code>
+<li> Expands to: <code>04 Sep 2004 $Rev: 1742 $</code>
 </li>
 <li> Related: <a class="twikiAnchorLink" href="#VarPLUGINVERSION">PL
UGINVERSION</a>, <a class="twikiAnchorLink" href="#VarWIKITOOLNAME">W
IKITOOLNAME</a>
 </li>
--- ../rel20040903/license.txt Fri Sep  9 18:04:46 2005
+++ ./license.txt       Tue Sep 20 16:33:21 2005
@@ -1,4 +1,4 @@
-Copyright and License of TWiki, 03 Sep 2004
+Copyright and License of TWiki, 04 Sep 2004
 -------------------------------------------
 
 TWiki (TM) is copyrighted (C) 1999-2004 by Peter Thoeny,
--- ../rel20040903/readme.txt  Fri Sep  9 18:05:03 2005
+++ ./readme.txt        Tue Sep 20 16:33:01 2005
@@ -5,7 +5,7 @@
 TWiki Distribution
 ------------------
 
-Version: 03 Sep 2004 $Rev: 1742 $
+Version: 04 Sep 2004 $Rev: 1742 $
 Release type: Production release
 
 This version is TWiki Release 01-Sep-2004 patched for
--- ../rel20040903/lib/TWiki.pm        Fri Sep  9 18:01:49 2005
+++ ./lib/TWiki.pm      Tue Sep 20 16:34:03 2005
@@ -154,7 +154,7 @@
 
 # ===========================
 # TWiki version:
-$wikiversion      = '03 Sep 2004 $Rev: 1742 $';
+$wikiversion      = '04 Sep 2004 $Rev: 1742 $';
 
 # ===========================
 # Key Global variables, required for writeDebug
--- ../rel20040903/lib/TWiki/Store.pm  Thu Sep  8 21:30:44 2005
+++ ./lib/TWiki/Store.pm        Tue Sep 20 16:46:05 2005
@@ -451,7 +451,9 @@
     my( $theWeb, $theTopic, $theRev ) = @_;
     my $topicHandler = _getTopicHandler( $theWeb, $theTopic );
 
-    $theRev =~ s/^1\.//o;
+    $theRev =~ s/^r?1\.//o;
+    # Fix for Codev.SecurityAlertExecuteCommandsWithInclude
+    $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
     return $topicHandler->getRevision( $theRev );
 }
 
@@ -468,7 +470,9 @@
    my ( $theWeb, $theTopic, $theAttachment, $theRev ) = @_;
 
    my $topicHandler = _getTopicHandler( $theWeb, $theTopic, $theAttachment );
-   $theRev =~ s/^1\.//o;
+   $theRev =~ s/^r?1\.//o;
+   # Fix for Codev.SecurityAlertExecuteCommandsWithInclude
+   $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
    return $topicHandler->getRevision( $theRev );
 }
 
@@ -574,7 +578,7 @@
     $theRev = "" unless( $theRev );
     $theRev =~ s/r?1\.//o;  # cut 'r' and major
     # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-    $theRev = "" unless( $theRev =~ s/.*?([0-9]+).*/$1/o );
+    $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
 
     $topicHandler = _getTopicHandler( $theWebName, $theTopic, $attachment ) if( ! $topicHandler );
     my( $rcsOut, $rev, $date, $user, $comment ) = $topicHandler->getRevisionInfo( $theRev );
--- ../rel20040903/lib/TWiki/UI/RDiff.pm       Thu Sep  8 21:33:13 2005
+++ ./lib/TWiki/UI/RDiff.pm     Tue Sep 20 16:41:08 2005
@@ -410,8 +410,8 @@
     $rev1 =~ s/r?1\.//go;  # cut 'r' and major
     $rev2 =~ s/r?1\.//go;  # cut 'r' and major
     # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-    $rev1 = $maxrev unless( $rev1 =~ s/.*?([0-9]+).*/$1/o );
-    $rev2 = $maxrev unless( $rev2 =~ s/.*?([0-9]+).*/$1/o );
+    $rev1 = $maxrev unless( $rev1 =~ s/^.*?([0-9]+).*$/$1/so );
+    $rev2 = $maxrev unless( $rev2 =~ s/^.*?([0-9]+).*$/$1/so );
     if( $rev1 < 1 )       { $rev1 = $maxrev; }
     if( $rev1 > $maxrev ) { $rev1 = $maxrev; }
     if( $rev2 < 1 )       { $rev2 = 1; }
--- ../rel20040903/lib/TWiki/UI/View.pm        Thu Sep  8 21:34:52 2005
+++ ./lib/TWiki/UI/View.pm      Tue Sep 20 16:42:24 2005
@@ -108,7 +108,7 @@
     if( $rev ) {
       $rev =~ s/r?1\.//go;  # cut 'r' and major
       # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-      $rev = $maxrev unless( $rev =~ s/.*?([0-9]+).*/$1/o );
+      $rev = $maxrev unless( $rev =~ s/^.*?([0-9]+).*$/$1/so );
       if( $rev < 1 )       { $rev = 1; }
       if( $rev > $maxrev ) { $rev = $maxrev; }
     } else {
--- ../rel20040903/lib/TWiki/UI/Viewfile.pm    Thu Sep  8 21:35:59 2005
+++ ./lib/TWiki/UI/Viewfile.pm  Tue Sep 20 16:41:51 2005
@@ -45,7 +45,7 @@
   my $rev = $query->param( 'rev' ) || "";
   $rev =~ s/r?1\.//o;  # cut 'r' and major
   # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-  $rev = "" unless( $rev =~ s/.*?([0-9]+).*/$1/o );
+  $rev = "" unless( $rev =~ s/^.*?([0-9]+).*$/$1/so );
 
   return unless TWiki::UI::webExists( $webName, $topic );
 
 
 
--------------B4F2E0599FAFA391B3E4117D
Content-Type: text/plain; charset=us-ascii;
 name="TWiki200409-02-04patch.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="TWiki200409-02-04patch.txt"
 
--- ../rel20040902/TWikiDocumentation.html     Tue Aug 31 09:35:18 2004
+++ ./TWikiDocumentation.html   Tue Sep 20 16:32:36 2005
@@ -1,7 +1,7 @@
 <html><head>
 <title>TWikiDocumentation</title>
 </head><body bgcolor="#ffffff">
-<h1><a name="TWiki_Reference_Manual_01_Sep_20"> </a><a name="_TW
iki_Reference_Manual_01_Sep_2"> </a>  TWiki Reference Manual (01 Sep 2004 $Rev: 1742 $)
 </h1>
+<h1><a name="TWiki_Reference_Manual_04_Sep_20"> </a><a name="_TW
iki_Reference_Manual_04_Sep_2"> </a>  TWiki Reference Manual (04 Sep 2004 $Rev: 1742 $)
 </h1>
 <p />
 <script type="text/javascript">
 <!--
@@ -3816,7 +3816,7 @@
 </li>
 </ul>
 <p />
-This version of TWiki - 01 Sep 2004 $Rev: 1742 $ - expands the following variables (enclosed in <
code><b>%</b></code> percent signs):
+This version of TWiki - 04 Sep 2004 $Rev: 1742 $ - expands the following variables (enclosed in <
code><b>%</b></code> percent signs):
 <p />
 <p />
 <p />
@@ -4627,7 +4627,7 @@
 <ul>
 <li> Syntax: <code>%WIKIVERSION%</code>
 </li>
-<li> Expands to: <code>01 Sep 2004 $Rev: 1742 $</code>
+<li> Expands to: <code>04 Sep 2004 $Rev: 1742 $</code>
 </li>
 <li> Related: <a class="twikiAnchorLink" href="#VarPLUGINVERSION">PL
UGINVERSION</a>, <a class="twikiAnchorLink" href="#VarWIKITOOLNAME">W
IKITOOLNAME</a>
 </li>
@@ -9836,4 +9836,4 @@
 </li>
 </ul>
 <p />
-</body></html>
+</body></html>
--- ../rel20040902/license.txt Fri Nov 19 21:31:10 2004
+++ ./license.txt       Tue Sep 20 16:33:21 2005
@@ -1,4 +1,4 @@
-Copyright and License of TWiki, 02 Sep 2004
+Copyright and License of TWiki, 04 Sep 2004
 -------------------------------------------
 
 TWiki (TM) is copyrighted (C) 1999-2004 by Peter Thoeny,
--- ../rel20040902/readme.txt  Fri Nov 19 21:37:33 2004
+++ ./readme.txt        Tue Sep 20 16:33:01 2005
@@ -5,7 +5,7 @@
 TWiki Distribution
 ------------------
 
-Version: 02 Sep 2004 $Rev: 1742 $
+Version: 04 Sep 2004 $Rev: 1742 $
 Release type: Production release
 
 This version is TWiki Release 01-Sep-2004 patched for
--- ../rel20040902/lib/TWiki.pm        Fri Nov 19 21:31:53 2004
+++ ./lib/TWiki.pm      Tue Sep 20 16:34:03 2005
@@ -154,7 +154,7 @@
 
 # ===========================
 # TWiki version:
-$wikiversion      = '02 Sep 2004 $Rev: 1742 $';
+$wikiversion      = '04 Sep 2004 $Rev: 1742 $';
 
 # ===========================
 # Key Global variables, required for writeDebug
--- ../rel20040902/lib/TWiki/Store.pm  Thu Jul 22 01:43:40 2004
+++ ./lib/TWiki/Store.pm        Tue Sep 20 16:46:05 2005
@@ -451,7 +451,9 @@
     my( $theWeb, $theTopic, $theRev ) = @_;
     my $topicHandler = _getTopicHandler( $theWeb, $theTopic );
 
-    $theRev =~ s/^1\.//o;
+    $theRev =~ s/^r?1\.//o;
+    # Fix for Codev.SecurityAlertExecuteCommandsWithInclude
+    $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
     return $topicHandler->getRevision( $theRev );
 }
 
@@ -468,7 +470,9 @@
    my ( $theWeb, $theTopic, $theAttachment, $theRev ) = @_;
 
    my $topicHandler = _getTopicHandler( $theWeb, $theTopic, $theAttachment );
-   $theRev =~ s/^1\.//o;
+   $theRev =~ s/^r?1\.//o;
+   # Fix for Codev.SecurityAlertExecuteCommandsWithInclude
+   $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
    return $topicHandler->getRevision( $theRev );
 }
 
@@ -572,7 +576,9 @@
     }
 
     $theRev = "" unless( $theRev );
-    $theRev =~ s/^1\.//o;
+    $theRev =~ s/r?1\.//o;  # cut 'r' and major
+    # Fix for Codev.SecurityAlertExecuteCommandsWithRev
+    $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
 
     $topicHandler = _getTopicHandler( $theWebName, $theTopic, $attachment ) if( ! $topicHandler );
     my( $rcsOut, $rev, $date, $user, $comment ) = $topicHandler->getRevisionInfo( $theRev );
--- ../rel20040902/lib/TWiki/UI/RDiff.pm       Sun Aug  8 01:28:45 2004
+++ ./lib/TWiki/UI/RDiff.pm     Tue Sep 20 16:41:08 2005
@@ -409,6 +409,9 @@
     if( ! $rev2 ) { $rev2 = 0; }
     $rev1 =~ s/r?1\.//go;  # cut 'r' and major
     $rev2 =~ s/r?1\.//go;  # cut 'r' and major
+    # Fix for Codev.SecurityAlertExecuteCommandsWithRev
+    $rev1 = $maxrev unless( $rev1 =~ s/^.*?([0-9]+).*$/$1/so );
+    $rev2 = $maxrev unless( $rev2 =~ s/^.*?([0-9]+).*$/$1/so );
     if( $rev1 < 1 )       { $rev1 = $maxrev; }
     if( $rev1 > $maxrev ) { $rev1 = $maxrev; }
     if( $rev2 < 1 )       { $rev2 = 1; }
--- ../rel20040902/lib/TWiki/UI/View.pm        Tue Aug 24 23:36:15 2004
+++ ./lib/TWiki/UI/View.pm      Tue Sep 20 16:42:24 2005
@@ -107,6 +107,8 @@
 
     if( $rev ) {
       $rev =~ s/r?1\.//go;  # cut 'r' and major
+      # Fix for Codev.SecurityAlertExecuteCommandsWithRev
+      $rev = $maxrev unless( $rev =~ s/^.*?([0-9]+).*$/$1/so );
       if( $rev < 1 )       { $rev = 1; }
       if( $rev > $maxrev ) { $rev = $maxrev; }
     } else {
--- ../rel20040902/lib/TWiki/UI/Viewfile.pm    Fri May 28 23:51:35 2004
+++ ./lib/TWiki/UI/Viewfile.pm  Tue Sep 20 16:41:51 2005
@@ -43,6 +43,9 @@
 
   my $fileName = $query->param( 'filename' );
   my $rev = $query->param( 'rev' ) || "";
+  $rev =~ s/r?1\.//o;  # cut 'r' and major
+  # Fix for Codev.SecurityAlertExecuteCommandsWithRev
+  $rev = "" unless( $rev =~ s/^.*?([0-9]+).*$/$1/so );
 
   return unless TWiki::UI::webExists( $webName, $topic );
 
 
 
--------------B4F2E0599FAFA391B3E4117D
Content-Type: text/plain; charset=us-ascii;
 name="TWiki200302-01-04patch.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="TWiki200302-01-04patch.txt"
 
--- lib/TWiki/Store.pm.orig2      Thu Sep  8 23:10:58 2005
+++ lib/TWiki/Store.pm    Tue Sep 20 17:19:49 2005
@@ -278,7 +278,9 @@
     my( $theWeb, $theTopic, $theRev ) = @_;
     my $topicHandler = _getTopicHandler( $theWeb, $theTopic );
 
-    $theRev =~ s/^1\.//o;
+    $theRev =~ s/^r?1\.//o;  # cut 'r' and major
+    # Fix for Codev.SecurityAlertExecuteCommandsWithInclude
+    $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
     return $topicHandler->getRevision( $theRev );
 }
 
@@ -288,7 +290,9 @@
    my ( $theWeb, $theTopic, $theAttachment, $theRev ) = @_;
 
    my $topicHandler = _getTopicHandler( $theWeb, $theTopic, $theAttachment );
-   $theRev =~ s/^1\.//o;
+   $theRev =~ s/^r?1\.//o;  # cut 'r' and major
+   # Fix for Codev.SecurityAlertExecuteCommandsWithInclude
+   $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
    return $topicHandler->getRevision( $theRev );
 }
 
@@ -352,9 +356,9 @@
         $theWebName = $TWiki::webName;
     }
 
-    $theRev =~ s/r?1\.//o;  # cut 'r' and major
+    $theRev =~ s/^r?1\.//o;  # cut 'r' and major
     # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-    $theRev = "" unless( $theRev =~ s/.*?([0-9]+).*/$1/o );
+    $theRev = "" unless( $theRev =~ s/^.*?([0-9]+).*$/$1/so );
 
     $topicHandler = _getTopicHandler( $theWebName, $theTopic, $attachment ) if( ! $topicHandler );
     my( $rcsOut, $rev, $date, $user, $comment ) = $topicHandler->getRevisionInfo( $theRev );
--- bin/rdiff.orig2 Thu Sep  8 23:18:05 2005
+++ bin/rdiff       Tue Sep 20 17:31:11 2005
@@ -156,8 +156,8 @@
         $rev1 =~ s/r?1\.//go;  # cut 'r' and major
         $rev2 =~ s/r?1\.//go;  # cut 'r' and major
         # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-        $rev1 = $maxrev unless( $rev1 =~ s/.*?([0-9]+).*/$1/o );
-        $rev2 = $maxrev unless( $rev2 =~ s/.*?([0-9]+).*/$1/o );
+        $rev1 = $maxrev unless( $rev1 =~ s/^.*?([0-9]+).*$/$1/so );
+        $rev2 = $maxrev unless( $rev2 =~ s/^.*?([0-9]+).*$/$1/so );
         if( $rev1 < 1 )       { $rev1 = $maxrev; }
         if( $rev1 > $maxrev ) { $rev1 = $maxrev; }
         if( $rev2 < 1 )       { $rev2 = 1; }
--- bin/view.orig2  Thu Sep  8 23:13:47 2005
+++ bin/view        Tue Sep 20 17:31:33 2005
@@ -124,7 +124,7 @@
         if( $rev ) {
             $rev =~ s/r?1\.//go;  # cut 'r' and major
             # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-            $rev = $maxrev unless( $rev =~ s/.*?([0-9]+).*/$1/o );
+            $rev = $maxrev unless( $rev =~ s/^.*?([0-9]+).*$/$1/so );
             if( $rev < 1 )       { $rev = 1; }
             if( $rev > $maxrev ) { $rev = $maxrev; }
         } else {
--- bin/viewfile.orig2      Thu Sep  8 23:14:54 2005
+++ bin/viewfile    Tue Sep 20 17:31:54 2005
@@ -65,7 +65,7 @@
     my $rev = $query->param( 'rev' ) || "";
     $rev =~ s/r?1\.//o;  # cut 'r' and major
     # Fix for Codev.SecurityAlertExecuteCommandsWithRev
-    $rev = "" unless( $rev =~ s/.*?([0-9]+).*/$1/o );
+    $rev = "" unless( $rev =~ s/^.*?([0-9]+).*$/$1/so );
     my $topRev = &TWiki::Store::getRevisionNumber( $webName, $topic, $fileName );
 
     if( ( $rev ) && ( $rev ne $topRev ) ) {
 
 
--------------B4F2E0599FAFA391B3E4117D--