On Wed, 20 Nov 2002, Greg A. Woods wrote:

> Of course such a fix is probably beyond the realm of pkgsrc unless
> someone wants to pioneer it and propose it as a fix to both pkgsrc and
> the original maintainers which both resolves what could be considered to
> be a rather serious security flaw; as well as being a fix to the
> filename collision issue which started this thread.

I patched blackbox over a year ago and provided diffs to blackbox
community (via mailing list and website) for:

allowRootCommand:       True
rootCommandApp: bsetbg -full

rootCommandApp:
        This defines the program to set the root image.
        It defaults to "bsetbg -full".

allowRootCommand:
        This can be set to "False" so a style's RootCommand
        will not be executed.

(Also patch helps so Theme (style) designers can add an optional
"RootImage" if the RootCommand is disabled.)

> I personally would think that would be a good security fix for pkgsrc to
> maintain regardless of what the original code maintainers do.  Even I

I agree. But keeping it in sync is another matter.

By the way, bsetroot can be used to set a gradient of colors for the
background; and bsetbg is configurable wrapper for bsetroot, display,
xli, xsetbg, Esetroot, qiv, wmsetbg, and xv.

   Jeremy C. Reed
   http://www.reedmedia.net/