zolrath / wemux

Multi-User Tmux Made Easy
MIT License
3.63k stars 139 forks source link

Add check that provided username argument in kick is indeed a user #11

Closed woodb closed 11 years ago

woodb commented 12 years ago

Major issue with lack of validation on kick

If the user enters a number to kick a user, the kill command might still catch sshd when the number is present in the ps and kill tons of ssh sessions unintentionally :(

Example

Note the first PID returned from the kick search string!

~# ps aux | grep "2.*sshd"
root     21922  0.0  0.2  41996  1276 ?        Ss   22:28   0:00 /usr/sbin/sshd
root     21926  0.0  0.7  65520  3548 ?        Ss   22:29   0:00 sshd: user1 [priv]
user1    21928  0.5  0.3  65648  1848 ?        S    22:29   0:01 sshd: user1@pts/0
root     21999  0.0  0.7  65520  3536 ?        Ss   22:29   0:00 sshd: user2 [priv]
user2    22001  0.5  0.6  67284  3376 ?        S    22:29   0:01 sshd: user2@pts/1
user2    22173  0.0  0.2   8680  1052 pts/2    S+   22:33   0:00 grep 2.*sshd
~# ps aux | grep "2.*sshd" | grep -v grep | tr -s ' ' | cut -d ' ' -f 2
21922
21926
21928
21999
zolrath commented 11 years ago

Fixed in #20, thanks for the report woodb and the fix DexterTheDragon!