blackbeard420/weechat
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

relay: use empty value by default for option relay.weechat.commands (issue #928)

Browse Source 
The relay client is supposed to be safe by default, and the relay connection
should be protected by the different ways (restriction on IP address, SSL,
strong password, Time-based One-Time Password, local bind address and use of
SSH tunnel…).

So this option lets the user add extra security by allowing only some
commands (whitelist), or allowing any commands except a list of given
commands (blacklist).
This commit is contained in:
Sébastien Helleu 2019-03-11 20:49:35 +01:00
parent e44c4904c3
commit 92e176ab89
21 changed files with 97 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/de/autogen/user/relay_options.adoc
View File

@ -183,7 +183,7 @@
** Standardwert: `+""+`
* [[option_relay.weechat.commands]] *relay.weechat.commands*
** Beschreibung: pass:none[durch Kommata getrennte Liste von Befehlen die erlaubt/verboten sind wenn Daten (Text oder Befehl) vom Client empfangen werden; "*" bedeutet alle Befehle sind erlaubt, beginnt ein Befehl hingegen mit "!" wird die Auswahl umgekehrt und der Befehl wird nicht ausgeführt, der Platzhalter "*" ist erlaubt; standardmäßig sind einige Befehle nicht erlaubt (die zu einem denial of service oder einer remote code execution führen können, wenn der Client nicht vertrauenswürdig ist)]
** Beschreibung: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; this option should be set if the relay client is not safe (someone could use it to run commands); for example "*,!exec,!quit" allows any command except /exec and /quit]
** Typ: Zeichenkette
** Werte: beliebige Zeichenkette
** Standardwert: `+"*,!exec,!fset,!guile,!javascript,!lua,!perl,!php,!plugin,!python,!quit,!repeat,!ruby,!script,!secure,!set,!tcl,!unset,!upgrade,!wait"+`
** Standardwert: `+""+`

4
doc/en/autogen/user/relay_options.adoc
View File

@ -183,7 +183,7 @@
** default value: `+""+`
* [[option_relay.weechat.commands]] *relay.weechat.commands*
** description: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; by default some commands are not allowed (they could lead to denial of service or remote code execution if the client is not trusted)]
** description: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; this option should be set if the relay client is not safe (someone could use it to run commands); for example "*,!exec,!quit" allows any command except /exec and /quit]
** type: string
** values: any string
** default value: `+"*,!exec,!fset,!guile,!javascript,!lua,!perl,!php,!plugin,!python,!quit,!repeat,!ruby,!script,!secure,!set,!tcl,!unset,!upgrade,!wait"+`
** default value: `+""+`

4
doc/fr/autogen/user/relay_options.adoc
View File

@ -183,7 +183,7 @@
** valeur par défaut: `+""+`
* [[option_relay.weechat.commands]] *relay.weechat.commands*
** description: pass:none[liste des commandes autorisées/interdites lorsque qu'une entrée de données (texte ou commande) est reçue du client (séparées par des virgules) ; "*" signifie toutes les commandes, un nom commençant par "!" est une valeur négative pour empêcher une commande d'être exécutée, le caractère joker "*" est autorisé dans les noms ; par défaut certaines commandes ne sont pas autorisées (elles pourraient conduire à un déni de service ou l'exécution de commandes à distance si le client n'est pas sûr)]
** description: pass:none[liste des commandes autorisées/interdites lorsque qu'une entrée de données (texte ou commande) est reçue du client (séparées par des virgules) ; "*" signifie toutes les commandes, un nom commençant par "!" est une valeur négative pour empêcher une commande d'être exécutée, le caractère joker "*" est autorisé dans les noms ; cette option devrait être définie si le client relay n'est pas sûr (quelqu'un pourrait l'utiliser pour exécuter des commandes) ; par exemple "*,!exec,!quit" autorise toute commande sauf /exec et /quit]
** type: chaîne
** valeurs: toute chaîne
** valeur par défaut: `+"*,!exec,!fset,!guile,!javascript,!lua,!perl,!php,!plugin,!python,!quit,!repeat,!ruby,!script,!secure,!set,!tcl,!unset,!upgrade,!wait"+`
** valeur par défaut: `+""+`

4
doc/it/autogen/user/relay_options.adoc
View File

@ -183,7 +183,7 @@
** valore predefinito: `+""+`
* [[option_relay.weechat.commands]] *relay.weechat.commands*
** descrizione: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; by default some commands are not allowed (they could lead to denial of service or remote code execution if the client is not trusted)]
** descrizione: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; this option should be set if the relay client is not safe (someone could use it to run commands); for example "*,!exec,!quit" allows any command except /exec and /quit]
** tipo: stringa
** valori: qualsiasi stringa
** valore predefinito: `+"*,!exec,!fset,!guile,!javascript,!lua,!perl,!php,!plugin,!python,!quit,!repeat,!ruby,!script,!secure,!set,!tcl,!unset,!upgrade,!wait"+`
** valore predefinito: `+""+`

4
doc/ja/autogen/user/relay_options.adoc
View File

@ -183,7 +183,7 @@
** デフォルト値: `+""+`
* [[option_relay.weechat.commands]] *relay.weechat.commands*
** 説明: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; by default some commands are not allowed (they could lead to denial of service or remote code execution if the client is not trusted)]
** 説明: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; this option should be set if the relay client is not safe (someone could use it to run commands); for example "*,!exec,!quit" allows any command except /exec and /quit]
** タイプ: 文字列
** 値: 未制約文字列
** デフォルト値: `+"*,!exec,!fset,!guile,!javascript,!lua,!perl,!php,!plugin,!python,!quit,!repeat,!ruby,!script,!secure,!set,!tcl,!unset,!upgrade,!wait"+`
** デフォルト値: `+""+`

4
doc/pl/autogen/user/relay_options.adoc
View File

@ -183,7 +183,7 @@
** domyślna wartość: `+""+`
* [[option_relay.weechat.commands]] *relay.weechat.commands*
** opis: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; by default some commands are not allowed (they could lead to denial of service or remote code execution if the client is not trusted)]
** opis: pass:none[comma-separated list of commands allowed/denied when input data (text or command) is received from a client; "*" means any command, a name beginning with "!" is a negative value to prevent a command from being executed, wildcard "*" is allowed in names; this option should be set if the relay client is not safe (someone could use it to run commands); for example "*,!exec,!quit" allows any command except /exec and /quit]
** typ: ciąg
** wartości: dowolny ciąg
** domyślna wartość: `+"*,!exec,!fset,!guile,!javascript,!lua,!perl,!php,!plugin,!python,!quit,!repeat,!ruby,!script,!secure,!set,!tcl,!unset,!upgrade,!wait"+`
** domyślna wartość: `+""+`

8
po/cs.po
View File

@ -21,7 +21,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: Ondřej Súkup <mimi.vx@gmail.com>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -10868,9 +10868,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
#, fuzzy

9
po/de.po
View File

@ -24,7 +24,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-03-09 19:33+0100\n"
"Last-Translator: Nils Görs <weechatter@arcor.de>\n"
"Language-Team: German <kde-i18n-de@kde.org>\n"
@ -12768,13 +12768,14 @@ msgstr ""
"gesendet wird); keine Zeichenkette = deaktiviert die Zeitanzeige im "
"Verlaufsspeicher"
#, fuzzy
msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
"durch Kommata getrennte Liste von Befehlen die erlaubt/verboten sind wenn "
"Daten (Text oder Befehl) vom Client empfangen werden; \"*\" bedeutet alle "

8
po/es.po
View File

@ -22,7 +22,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: Elián Hanisch <lambdae2@gmail.com>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -11221,9 +11221,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
#, fuzzy

17
po/fr.po
View File

@ -21,8 +21,8 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"PO-Revision-Date: 2019-03-09 17:51+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-03-11 20:48+0100\n"
"Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
"Language: fr\n"
@ -12495,17 +12495,18 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
"liste des commandes autorisées/interdites lorsque qu'une entrée de données "
"(texte ou commande) est reçue du client (séparées par des virgules) ; \"*\" "
"signifie toutes les commandes, un nom commençant par \"!\" est une valeur "
"négative pour empêcher une commande d'être exécutée, le caractère joker \"*"
"\" est autorisé dans les noms ; par défaut certaines commandes ne sont pas "
"autorisées (elles pourraient conduire à un déni de service ou l'exécution de "
"commandes à distance si le client n'est pas sûr)"
"\" est autorisé dans les noms ; cette option devrait être définie si le "
"client relay n'est pas sûr (quelqu'un pourrait l'utiliser pour exécuter des "
"commandes) ; par exemple \"*,!exec,!quit\" autorise toute commande sauf /"
"exec et /quit"
msgid "number of clients for relay"
msgstr "nombre de clients pour le relai"

8
po/hu.po
View File

@ -20,7 +20,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:18+0100\n"
"Last-Translator: Andras Voroskoi <voroskoi@frugalware.org>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -10227,9 +10227,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
#, fuzzy

8
po/it.po
View File

@ -20,7 +20,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: Esteban I. Ruiz Moreno <exio4.com@gmail.com>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -11423,9 +11423,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
#, fuzzy

8
po/ja.po
View File

@ -20,7 +20,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: AYANOKOUZI, Ryuunosuke <i38w7i3@yahoo.co.jp>\n"
"Language-Team: Japanese <https://github.com/l/weechat/tree/master/"
@ -12043,9 +12043,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
msgid "number of clients for relay"

8
po/pl.po
View File

@ -22,7 +22,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: Krzysztof Korościk <soltys@soltys.info>\n"
"Language-Team: Polish <kde-i18n-doc@kde.org>\n"
@ -12227,9 +12227,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
msgid "number of clients for relay"

8
po/pt.po
View File

@ -20,7 +20,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: Vasco Almeida <vascomalmeida@sapo.pt>\n"
"Language-Team: Portuguese <>\n"
@ -11883,9 +11883,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
msgid "number of clients for relay"

8
po/pt_BR.po
View File

@ -21,7 +21,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:53+0100\n"
"Last-Translator: Eduardo Elias <camponez@gmail.com>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -10676,9 +10676,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
#, fuzzy

8
po/ru.po
View File

@ -21,7 +21,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-02-28 20:19+0100\n"
"Last-Translator: Aleksey V Zapparov AKA ixti <ixti@member.fsf.org>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -10260,9 +10260,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
#, fuzzy

8
po/tr.po
View File

@ -20,7 +20,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2019-01-29 21:05+0100\n"
"Last-Translator: Hasan Kiran <sunder67@hotmail.com>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -9322,9 +9322,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
msgid "number of clients for relay"

8
po/weechat.pot
View File

@ -21,7 +21,7 @@ msgid ""
msgstr ""
"Project-Id-Version: WeeChat\n"
"Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
"POT-Creation-Date: 2019-03-09 17:49+0100\n"
"POT-Creation-Date: 2019-03-11 20:47+0100\n"
"PO-Revision-Date: 2014-08-16 10:27+0200\n"
"Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
"Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@ -9189,9 +9189,9 @@ msgid ""
"comma-separated list of commands allowed/denied when input data (text or "
"command) is received from a client; \"*\" means any command, a name "
"beginning with \"!\" is a negative value to prevent a command from being "
"executed, wildcard \"*\" is allowed in names; by default some commands are "
"not allowed (they could lead to denial of service or remote code execution "
"if the client is not trusted)"
"executed, wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run commands); for "
"example \"*,!exec,!quit\" allows any command except /exec and /quit"
msgstr ""
msgid "number of clients for relay"

32
src/plugins/relay/relay-config.c
View File

@ -1039,33 +1039,11 @@ relay_config_init ()
"data (text or command) is received from a client; "
"\"*\" means any command, a name beginning with \"!\" is "
"a negative value to prevent a command from being executed, "
"wildcard \"*\" is allowed in names; by default some commands "
"are not allowed (they could lead to denial of service or remote "
"code execution if the client is not trusted)"),
NULL, 0, 0,
"*,"
"!exec,"
"!fset,"
"!guile,"
"!javascript,"
"!key,"
"!lua,"
"!perl,"
"!php,"
"!plugin,"
"!python,"
"!quit,"
"!repeat,"
"!ruby,"
"!script,"
"!secure,"
"!set,"
"!tcl,"
"!trigger,"
"!unset,"
"!upgrade,"
"!wait",
NULL, 0,
"wildcard \"*\" is allowed in names; this option should be set if "
"the relay client is not safe (someone could use it to run "
"commands); for example \"*,!exec,!quit\" allows any command "
"except /exec and /quit"),
NULL, 0, 0, "", NULL, 0,
NULL, NULL, NULL,
NULL, NULL, NULL,
NULL, NULL, NULL);

33
src/plugins/relay/weechat/relay-weechat-protocol.c
View File

@ -402,6 +402,7 @@ relay_weechat_protocol_input_timer_cb (const void *pointer,
int remaining_calls)
{
char **timer_args;
const char *ptr_weechat_commands;
int i;
struct t_gui_buffer *ptr_buffer;
struct t_hashtable *options;
@ -420,18 +421,28 @@ relay_weechat_protocol_input_timer_cb (const void *pointer,
ptr_buffer = weechat_buffer_search ("==", timer_args[0]);
if (ptr_buffer)
{
options = weechat_hashtable_new (8,
WEECHAT_HASHTABLE_STRING,
WEECHAT_HASHTABLE_STRING,
NULL, NULL);
if (options)
ptr_weechat_commands = weechat_config_string (
relay_config_weechat_commands);
if (ptr_weechat_commands && ptr_weechat_commands[0])
{
weechat_hashtable_set (
options,
"commands",
weechat_config_string (relay_config_weechat_commands));
weechat_command_options (ptr_buffer, timer_args[1], options);
weechat_hashtable_free (options);
options = weechat_hashtable_new (8,
WEECHAT_HASHTABLE_STRING,
WEECHAT_HASHTABLE_STRING,
NULL, NULL);
if (options)
{
weechat_hashtable_set (
options,
"commands",
weechat_config_string (relay_config_weechat_commands));
weechat_command_options (ptr_buffer, timer_args[1],
options);
weechat_hashtable_free (options);
}
}
else
{
weechat_command (ptr_buffer, timer_args[1]);
}
}
}