Forum OpenACS Q&A: Re: Security hole in ad_form (may change behavior of ad_form to fix!)

Users should never be allowed to execute any code at random points like this. But if Lars' suggestion works, it is simple enough, even if ugly. There is no way to enforce users to do it that way, and I bet this is something that will keep slipping through. I don't think it is a disaster because there are probably very few users that would want to exploit the problem.

What we really need is a detailed account of the extent of the problem and how and why to correct it in one way or another. At the moment, it isn't even apparent that the problem is in ad_form, and Lars' solution indicates it isn't.

Well subst is being called for a purpose. The question seems to be if ad_form is being fed the correct information. ad_form cannot know, and should not care where the string came from. At least that is what I am guessing.