svn commit: r504132 - head/security/vuxml

[Alexey Dokuchaev]

On Sat, Jun 15, 2019 at 07:32:52PM +0000, Alexey Dokuchaev wrote:
> ...
> I personally prefer to :set ts=4 manually, but I understand it can be
> a handy feature for others.  Then again, it should not be hard to show
> users how to enable it if they wish, e.g. by placing a very visible
> comment in the etc/vim/vimrc or via port's pkg-message.
> 
> I don't a strong opinion here, let's hear what others have to say.

Actually, the right way is to enable modelines, but disable :source (with !
modifier for running arbitrary commands) and execute()/assert_fails().  It's
just plain wrong that in order to protect oneself from

  :!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="

one must disable innocent ex:ts=4.  I hope that Vim folks would make it
more granular than just yes or no to all modelines.

./danfe