Security issue: Full server path returned to the client

[Wolfgang Loch]

Client: cvs-1-12.3
Server: cvsnt-1.11.2
Protocol: :pserver:

I noticed the when you do a "cvs remove FILE" followed by "cvs commit",
the client shows the full path name of the file on the CVS server. I
consider this is a security risk. The client should never see the actual
path on the server.

On the other hand, the client should be allowed to specify full path
names on the client machine, independent of the protocol in use.
Currently you can work with full path names if you are using the :local:
protocol with UNC path names. But when you switch to another protocol,
your existing scripts will stop working. This can be quite suprising.

Wolfgang