jeffreyhorner / Rook

A web server interface for R
161 stars 30 forks source link

Rook apps are not secured against manipulation from local users #24

Open jranke opened 10 years ago

jranke commented 10 years ago

As far as I understand (see gWidgetsWWW2 issue 22), Rook apps can be quite easily manipulated by other users on a multiuser system. This makes it possible to run arbitrary R code including system calls with the privileges of the user running the Rook app.

Would it be possible to add some basic security mechanism to prevent this?