bugmldonkey, a multi-networks file-sharing client - Bugs: bug #17456, shell commands broken

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #17456: shell commands broken

Submitted by:  orbit <orbit>
Submitted on:  Thu 17 Aug 2006 11:53:34 PM UTC  
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Ready For Test
Assigned to:  None Open/Closed:  Closed
Release:  Release:  2.7.7
Operating System:  Linux Binaries Origin:  CVS / Self compiled
CPU type:  None

Fri 18 Aug 2006 06:58:32 PM UTC, comment #2: 

case 2:
allowed_commands = [
(df, df);
(ls, "ls incoming");]
allow_any_command = true

=================================================================

> ! "ls incoming"

directories
files

---------------- Exited with code 0

- This works now with the attached patch
=================================================================

> ! mount

/dev/sdb1 on / type reiserfs (rw,noatime,notail,user_xattr)
...

- This works now with the attached patch

=================================================================

"mldonkey gets the password uncrypted so this would be a major security risk if it would work ;)"

Because of uncrypted passwords its important users set
allowed_ips to a correct value. With such a good protection
using "!" command should be no problem.
What about having "!" restricted to admin users in multiuser patch?

spiralvoice <spiralvoice>
Project Administrator
Fri 18 Aug 2006 06:54:24 PM UTC, comment #1: 

I will only list results other than yours + explanations.
Also you found two bugs;-)

case 1:
allowed_commands = [
(df, df);
(ls, "ls incoming");]
allow_any_command = false

Output on my machine:
===========================================================

> ! ls

directories
files

---------------- Exited with code 0
===========================================================
! ls incoming
For arbitrary commands, you must set 'allowed_any_command'

- This output is correct, because of allow_any_command = false
you can only use commands which are on the left side in
allowed_commands list:

! ls

is not the same as

! ls incoming

When you call "! ls" MLDonkey looks into allowed_commands list,
finds "ls" and executes the associated command "ls incoming",
allowed_commands is not only a list of allowed commands, but
also a list of command shortcuts.
===========================================================

> ! mount

For arbitrary commands, you must set 'allowed_any_command'

- This works now with the patch attached to this bug report.

spiralvoice <spiralvoice>
Project Administrator
Thu 17 Aug 2006 11:53:34 PM UTC, original submission:  

case 1:
 allowed_commands = [
  (df, df);
  (ls, "ls incoming");]
 allow_any_command = false

> ! ls

---------------- Exited with code 1
  OK

> ! ls /

For arbitrary commands, you must set 'allowed_any_command'
  OK

> ! ls incoming

For arbitrary commands, you must set 'allowed_any_command'
  False, this should work

> ! "ls incoming"


  False, should be the same as last

> ! mount


  False, there should be the error message

-------------------------------------------

case 2:
 allowed_commands = [
  (df, df);
  (ls, "ls incoming");]
 allow_any_command = true

> ! ls

---------------- Exited with code 1
  OK

> ! ls /

/:
bin
boot
...
  OK

> ! ls incoming

---------------- Exited with code 1
  OK

> ! "ls incoming"


  False, should be the same as last

> ! mount


  False, this should work when allow_any_command = true

-------------------------------------------

So allow_any_command option doesn't work
and ! doesn't work correct

anyway, mldonkey gets the password uncrypted so this would be a major security risk
if it would work ;)

I suggest remove allow_any_command or remove shell commands completely. I doubt someone will miss this feature.

orbit <orbit>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

 

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-08-27 spiralvoice Reassign ItemFrom group mldonkey, a multi-networks file-sharing client, bugs tracker => To group mldonkey, a multi-networks file-sharing client, patch tracker
2006-08-18 spiralvoice StatusNone => Ready For Test
2006-08-18 spiralvoice Attached File- => Added commands.patch, #10558

Back to the top


Powered by Savane 3.5