Mercurial > p > roundup > code
view scripts/server-ctl @ 5257:928512faf565
- issue2550864: Potential information leakage via journal/history
Original code didn't fully implement the security checks.
Users with only Edit access on a property were not able to view the
journal entry for the property. This patch fixes that.
Also had additional info leakage: the target object of a link or
multilink must be viewable or editable in order for the journal entry
to be shown. Otherwise the existance of the target is exposed via the
journal while it is blocked from searches, direct access etc.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sun, 27 Aug 2017 00:19:48 -0400 |
| parents | 311ad623e2d1 |
| children |
line wrap: on
line source
#!/bin/sh # # Configuration # CONFFILE="/var/roundup/server-config.ini" # this will end up with extra space, but it should be ignored in the script PIDFILE=`grep '^pidfile' ${CONFFILE} | awk -F = '{print $2}' ` SERVER="/usr/local/bin/roundup-server -C ${CONFFILE}" ERROR=0 ARGV="$@" if [ "x$ARGV" = "x" ] ; then ARGS="help" fi if [ -z "${PIDFILE}" ] ; then echo "pidfile option must be set in configuration file" exit 1 fi for ARG in $@ $ARGS do # check for pidfile if [ -f $PIDFILE ] ; then PID=`cat $PIDFILE` if [ "x$PID" != "x" ] && kill -0 $PID 2>/dev/null ; then STATUS="roundup-server (pid $PID) running" RUNNING=1 else STATUS="roundup-server (pid $PID?) not running" RUNNING=0 fi else STATUS="roundup-server (no pid file) not running" RUNNING=0 fi case $ARG in start) if [ $RUNNING -eq 1 ] ; then echo "$0 $ARG: roundup-server (pid $PID) already running" continue fi if $SERVER ; then echo "$0 $ARG: roundup-server started" else echo "$0 $ARG: roundup-server could not be started" ERROR=1 fi ;; condstart) if [ $RUNNING -eq 1 ] ; then continue fi if $SERVER ; then echo "$0 $ARG: roundup-server started" else echo "$0 $ARG: roundup-server could not be started" ERROR=1 fi ;; stop) if [ $RUNNING -eq 0 ] ; then echo "$0 $ARG: $STATUS" continue fi if kill $PID ; then echo "$0 $ARG: roundup-server stopped" else echo "$0 $ARG: roundup-server could not be stopped" ERROR=2 fi ;; status) echo $STATUS ;; *) echo "usage: $0 (start|condstart|stop|status)" cat <<EOF start - start roundup-server condstart - start roundup-server if it's not running stop - stop roundup-server status - display roundup-server status EOF ERROR=3 ;; esac done exit $ERROR
