limit the update-check.cgi to parse for cmd=download and not parse arbitrary query string options.

Author: jens-maus

VERSION

@@ -1 +1 @@
-2.4
+2.5

www/update-check.cgi

@@ -7,8 +7,9 @@ catch {
   set input $env(QUERY_STRING)
   set pairs [split $input &]
   foreach pair $pairs {
-    if {0 != [regexp "^(\[^=]*)=(.*)$" $pair dummy varname val]} {
-      set $varname $val
+    if {$pair == "cmd=download"} {
+      set cmd "download"
+      break
     }
   }
 }