bugmldonkey, a multi-networks file-sharing client - Bugs: bug #17456, shell commands broken

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #17456: shell commands broken

Submitted by:  orbit <orbit>
Submitted on:  Thu 17 Aug 2006 11:53:34 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Ready For Test
Assigned to: NoneOpen/Closed: Closed
Release: Release: 2.7.7
Operating System: LinuxBinaries Origin: CVS / Self compiled
CPU type: None

Fri 18 Aug 2006 06:58:32 PM UTC, comment #2:

case 2:
allowed_commands = [
(df, df);
(ls, "ls incoming");]
allow_any_command = true

=================================================================

> ! "ls incoming"

directories
files

---------------- Exited with code 0

- This works now with the attached patch
=================================================================

> ! mount

/dev/sdb1 on / type reiserfs (rw,noatime,notail,user_xattr)
...

- This works now with the attached patch

=================================================================

"mldonkey gets the password uncrypted so this would be a major security risk if it would work ;)"

Because of uncrypted passwords its important users set
allowed_ips to a correct value. With such a good protection
using "!" command should be no problem.
What about having "!" restricted to admin users in multiuser patch?

spiralvoice <spiralvoice>
Project Administrator
Fri 18 Aug 2006 06:54:24 PM UTC, comment #1:

I will only list results other than yours + explanations.
Also you found two bugs;-)

case 1:
allowed_commands = [
(df, df);
(ls, "ls incoming");]
allow_any_command = false

Output on my machine:
===========================================================

> ! ls

directories
files

---------------- Exited with code 0
===========================================================
! ls incoming
For arbitrary commands, you must set 'allowed_any_command'

- This output is correct, because of allow_any_command = false
you can only use commands which are on the left side in
allowed_commands list:

! ls

is not the same as

! ls incoming

When you call "! ls" MLDonkey looks into allowed_commands list,
finds "ls" and executes the associated command "ls incoming",
allowed_commands is not only a list of allowed commands, but
also a list of command shortcuts.
===========================================================

> ! mount

For arbitrary commands, you must set 'allowed_any_command'

- This works now with the patch attached to this bug report.

spiralvoice <spiralvoice>
Project Administrator
Thu 17 Aug 2006 11:53:34 PM UTC, original submission:

case 1:
allowed_commands = [
(df, df);
(ls, "ls incoming");]
allow_any_command = false

> ! ls

---------------- Exited with code 1
OK

> ! ls /

For arbitrary commands, you must set 'allowed_any_command'
OK

> ! ls incoming

For arbitrary commands, you must set 'allowed_any_command'
False, this should work

> ! "ls incoming"


False, should be the same as last

> ! mount


False, there should be the error message

-------------------------------------------

case 2:
allowed_commands = [
(df, df);
(ls, "ls incoming");]
allow_any_command = true

> ! ls

---------------- Exited with code 1
OK

> ! ls /

/:
bin
boot
...
OK

> ! ls incoming

---------------- Exited with code 1
OK

> ! "ls incoming"


False, should be the same as last

> ! mount


False, this should work when allow_any_command = true

-------------------------------------------

So allow_any_command option doesn't work
and ! doesn't work correct

anyway, mldonkey gets the password uncrypted so this would be a major security risk
if it would work ;)

I suggest remove allow_any_command or remove shell commands completely. I doubt someone will miss this feature.

orbit <orbit>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 27 Aug 2006 05:43:25 PM UTCspiralvoiceReassign ItemFrom group mldonkey, a multi-networks file-sharing client, bugs tracker=>To group mldonkey, a multi-networks file-sharing client, patch tracker
Fri 18 Aug 2006 10:54:51 PM UTCspiralvoiceStatusNone=>Ready For Test
Fri 18 Aug 2006 07:03:07 PM UTCspiralvoiceAttached File-=>Added commands.patch, #10558

Back to the top


Powered by Savane 3.1-cleanup1