Shell autocomplete reveals forbidden directories

ghantoos / lshell

lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.

GNU General Public License v3.0

436 stars 111 forks source link

Shell autocomplete reveals forbidden directories #109

Closed mhindery closed 9 years ago

mhindery commented 9 years ago

The autocomplete feature allows users to list directories, whil they do not have access to those paths. Is there a way to disable this behaviour?

Example: cd /etc/ -> press tab and the /etc directory will be listed.

ghantoos commented 9 years ago

This is quite serious. I thought I had a test to prevent such a regression. I'll be working on it asap.

ghantoos commented 9 years ago

Corrected the completion, and added a test.

Thanks for reporting this bug!