search

37Rb / nextcloud-hledger

Plain Text Accounting on Nextcloud
GNU Affero General Public License v3.0
13 stars 2 forks source link

Admin setting to set hledger exe path #4

Open 37Rb opened 3 years ago

37Rb commented 3 years ago

We attempt to download and install hledger automatically with composer. But it only works with the 3 released hledger binaries. We need to give the admin a way to install hledger manually in case as an alternative.

thecount2a commented 3 years ago

This is a good idea but keep in mind that providing the end user the opportunity to define something that will end up being executed on the command-line is a significant security risk. We may struggle to get the app approved with nextcloud if we don't put thought into how this implemented, taking security in mind. Simply "sanitizing the input" may not be sufficient because any binary on the system can be specified. Thankfully, since this should be an "admin only" setting, maybe this security concern is not significant, since admins should be trusted in the first place. Not sure, it depends on how strictly they audit nextcloud apps.

37Rb commented 3 years ago

It would definitely be admin only. Maybe this would be best done in a PHP config file instead of the admin UI?