This commit was generated by cvs2svn to compensate for changes in r124793,

which included commits to RCS files with non-trunk default branches.

contrib/cvs/src/modules.c

@@ -159,6 +159,17 @@ do_module (db, mname, m_type, msg, callback_proc, where, shorten,
     }
 #endif
 
+    /* Don't process absolute directories.  Anything else could be a security
+     * problem.  Before this check was put in place:
+     *
+     *   $ cvs -d:fork:/cvsroot co /foo
+     *   cvs server: warning: cannot make directory CVS in /: Permission denied
+     *   cvs [server aborted]: cannot make directory /foo: Permission denied
+     *   $
+     */
+    if (isabsolute (mname))
+	error (1, 0, "Absolute module reference invalid: `%s'", mname);
+
     /* if this is a directory to ignore, add it to that list */
     if (mname[0] == '!' && mname[1] != '\0')
     {