sillsdev / LfMerge

Send/Receive for languageforge.org
MIT License
2 stars 4 forks source link

Change environment variable names for Language Depot #325

Closed rmunn closed 1 year ago

rmunn commented 1 year ago

All LD_* env vars in LfMerge will now be named LFMERGE_LANGUAGE_DEPOT_* instead. This is because Linux sudo (which LfMerge uses to run as the www-data user) is configured by default to discard any environment variables whose name starts with LD_, for security reasons. E.g., if you can mess with the LD_LIBRARY_PATH env var used by a program executing with privilege, you can inject arbitrary code into a privileged process and get it run.

So all environment variables used to tell LfMerge where to look for Language Depot now start with the LFMERGE_LANGUAGE_DEPOT_ prefix. They are now documented in the README, and they can all be found in the MagicStrings.cs file in case I missed any in the README.

github-actions[bot] commented 1 year ago

Test Results

    2 files  ±0    20 suites  ±0   6m 45s :stopwatch: +17s 307 tests ±0  287 :heavy_check_mark: ±0  20 :zzz: ±0  0 :x: ±0  310 runs  ±0  290 :heavy_check_mark: ±0  20 :zzz: ±0  0 :x: ±0 

Results for commit 1d05f332. ± Comparison against base commit 563fa8ca.