search

hexparrot / mineos-node

node.js implementation of mineos minecraft management
GNU General Public License v3.0
335 stars 169 forks source link

webui silently crashes if server directory owned by bad UID/GID #35

Closed hexparrot closed 9 years ago

hexparrot commented 9 years ago

The webui crashes if a server directory within base_dir is owned by a UID/GID that does not exist on the system:

drwxr-xr-x 2 1001 1001 4096 May 6 14:12 testing

This problem can be reproduced by running sudo nodeunit test/test-mineos.js; the tests will continue until test.chown() at which point if the user that is hardcoded into the test suite does not exist, nodeunit will silently crash.

This is the only test that utilizes (and hardcodes) a UID/GID other than 0, so it should probably check for a valid non-root user before continuing or skip the test automatically.

Subsequent attempts to use the web-ui will also fail when it tries to check the server owner and the web-ui silently crashes to the terminal as well. Deleting the errant server will restore all operation to normal, as will creating user/group 1001.

flareofghast commented 9 years ago

Would this be possible in production though?

hexparrot commented 9 years ago

Definitely possible. Inspect the dropdown element and change the UID value to something invalid and it'll crash the web-ui.

flareofghast commented 9 years ago

I wouldn't expect someone to do that in production but +1 for robust code :)

Arzte commented 9 years ago

+1 for robust code

hexparrot commented 9 years ago

64f6e53eb84232c2ac7ee3a9789c9ec1050b5838 fixes this.