Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-08 23:28:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

EventManager: disable commands by default

Browse Source 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2024-11-10 11:52:31 +01:00
parent d0f348a46a
commit f07c9a7e01
4 changed files with 47 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
internal/common/protocol_test.go
View File

@@ -3928,6 +3928,11 @@ func TestEventRule(t *testing.T) {
err = os.WriteFile(uploadScriptPath, getUploadScriptContent(movedPath, "", 0), 0755)
assert.NoError(t, err)
dataprovider.EnabledActionCommands = []string{uploadScriptPath}
defer func() {
dataprovider.EnabledActionCommands = nil
}()
action1.Type = dataprovider.ActionTypeCommand
action1.Options = dataprovider.BaseEventActionOptions{
CmdConfig: dataprovider.EventActionCommandConfig{
@@ -4265,6 +4270,10 @@ func TestEventRuleDisabledCommand(t *testing.T) {
},
},
}
_, _, err = httpdtest.AddEventAction(a1, http.StatusBadRequest)
assert.NoError(t, err)
// Enable the command to allow saving
dataprovider.EnabledActionCommands = []string{a1.Options.CmdConfig.Cmd}
action1, _, err := httpdtest.AddEventAction(a1, http.StatusCreated)
assert.NoError(t, err)
action2, _, err := httpdtest.AddEventAction(a2, http.StatusCreated)
@@ -4312,8 +4321,8 @@ func TestEventRuleDisabledCommand(t *testing.T) {
}
rule, _, err := httpdtest.AddEventRule(r, http.StatusCreated)
assert.NoError(t, err)
// restrit command execution
dataprovider.EnabledActionCommands = []string{"/bin/ls"}
// restrict command execution
dataprovider.EnabledActionCommands = nil
lastReceivedEmail.reset()
// create a folder to trigger the rule
@@ -4335,8 +4344,6 @@ func TestEventRuleDisabledCommand(t *testing.T) {
assert.Contains(t, email.Data, fmt.Sprintf("Object name: %s object type: folder", folder.Name))
lastReceivedEmail.reset()
dataprovider.EnabledActionCommands = nil
_, err = httpdtest.RemoveFolder(folder, http.StatusOK)
assert.NoError(t, err)
@@ -4368,6 +4375,11 @@ func TestEventRuleProviderEvents(t *testing.T) {
err = os.WriteFile(saveObjectScriptPath, getSaveProviderObjectScriptContent(outPath, 0), 0755)
assert.NoError(t, err)
dataprovider.EnabledActionCommands = []string{saveObjectScriptPath}
defer func() {
dataprovider.EnabledActionCommands = nil
}()
a1 := dataprovider.BaseEventAction{
Name: "a1",
Type: dataprovider.ActionTypeCommand,
@@ -5200,6 +5212,11 @@ func TestEventActionCommandEnvVars(t *testing.T) {
envName := "MY_ENV"
uploadScriptPath := filepath.Join(os.TempDir(), "upload.sh")
dataprovider.EnabledActionCommands = []string{uploadScriptPath}
defer func() {
dataprovider.EnabledActionCommands = nil
}()
err := os.WriteFile(uploadScriptPath, getUploadScriptEnvContent(envName), 0755)
assert.NoError(t, err)
a1 := dataprovider.BaseEventAction{