ghantoos / lshell

lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.
GNU General Public License v3.0
436 stars 112 forks source link

Access cannot be allowed to path '/'. #93

Closed DinkyToyz closed 9 years ago

DinkyToyz commented 9 years ago

When the the pattern for path '/' is added to the list of paths, it is incorrectly added as '//.*|'. The patch below adds it as '/.*|' as it should be.

--- lshell-master\lshell\checkconfig.py Mon Sep  8 21:04:28 2014
+++ lshell\lshell\checkconfig.py    Sun Feb  8 16:10:06 2015
@@ -400,7 +400,10 @@
                             liste = ['', '']
                             for path in eval(stuff):
                                 for item in glob.glob(path):
-                                    liste[0] += os.path.realpath(item) + '/.*|'
+                                    realpath = os.path.realpath(item)
+                                    if not realpath.endswith('/'):
+                                        realpath += '/'
+                                    liste[0] += os.path.realpath(item) + '.*|'
                             self.conf_raw.update({key:str(liste)})
                         elif stuff and type(eval(stuff)) is list:
                             self.conf_raw.update({key:stuff})
@@ -411,7 +414,10 @@
                     liste = ['', '']
                     for path in self.myeval(value, 'path'):
                         for item in glob.glob(path):
-                            liste[0] += os.path.realpath(item) + '/.*|'
+                            realpath = os.path.realpath(item)
+                            if not realpath.endswith('/'):
+                                realpath += '/'
+                            liste[0] += realpath + '.*|'
                     self.conf_raw.update({key:str(liste)})
                 else:
                     self.conf_raw.update(dict([item]))

Regards /Jonas

ghantoos commented 9 years ago

Hey Jonas,

This was corrected in my last commit, some weeks ago (https://github.com/ghantoos/lshell/commit/2645042e656afbb96f750fd907c1e530fad11525). I just realised that you had sent me a patch!

I still must thank you for your contribution. :)