From 2aef91b1871c575c29388bcf3b911ca5ecc513f6 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Fri, 1 Mar 2019 12:58:21 -0800 Subject: [PATCH] config: Don't pass configuration file argument to action Due to security risk that a compromised Plinth process will give adversary the ability to write to any file on the system. Signed-off-by: Sunil Mohan Adapa --- actions/config | 19 +++++++------------ plinth/modules/config/__init__.py | 3 +-- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/actions/config b/actions/config index fdbab17c4..7fe23fdb8 100755 --- a/actions/config +++ b/actions/config @@ -26,7 +26,8 @@ import os import augeas from plinth import action_utils -from plinth.modules.config import APACHE_HOMEPAGE_CONF_FILE_NAME +from plinth.modules.config import (APACHE_HOMEPAGE_CONF_FILE_NAME, + FREEDOMBOX_APACHE_CONFIG) def parse_arguments(): @@ -40,11 +41,8 @@ def parse_arguments(): set_home_page.add_argument('homepage', help='path to the webserver home page') - reset_home_page = subparsers.add_parser( - 'reset-home-page', help='Reset the homepage of the Apache server.') - reset_home_page.add_argument( - '--config', default=APACHE_HOMEPAGE_CONF_FILE_NAME, - help='(optional) path to the Apache config file') + subparsers.add_parser('reset-home-page', + help='Reset the homepage of the Apache server.') subparsers.required = True return parser.parse_args() @@ -63,12 +61,9 @@ def subcommand_set_home_page(arguments): action_utils.webserver_enable('freedombox-apache-homepage') -def subcommand_reset_home_page(arguments): - """Sets the Apache web server's home page to the default - /plinth - - The config file path can be optionally passed as an argument. - """ - config_file = arguments.config +def subcommand_reset_home_page(_): + """Sets the Apache web server's home page to the default - /plinth.""" + config_file = FREEDOMBOX_APACHE_CONFIG default_path = 'plinth' aug = augeas.Augeas( diff --git a/plinth/modules/config/__init__.py b/plinth/modules/config/__init__.py index f7ccaa70a..188f9f79d 100644 --- a/plinth/modules/config/__init__.py +++ b/plinth/modules/config/__init__.py @@ -124,8 +124,7 @@ def _migrate_home_page_config(): home_page_path = get_home_page().replace('_', '/') # Reset the home page to plinth in freedombox.conf - actions.superuser_run( - 'config', ['reset-home-page', '--config', FREEDOMBOX_APACHE_CONFIG]) + actions.superuser_run('config', ['reset-home-page']) # Write the home page setting into the new conf file # This step is run at the end because it reloads the Apache server