LivelyKernel / LivelyKernel/lively.next
Disable Shell Access
@linusha is already working on this.
Since Jun 2, 2021.
- Dominant language
- JavaScript
- Stars
- 90
- Forks
- 20
- PR merge metrics
- No merged PRs in 30d
Description
This is probably a small part of some larger things that need to be thought through (that is security of lively in general^^), but this concrete point was brought up by @frcroth and I think it is a good starting point:
Since yesterday we have a lively instance that is open available to the web and there are already some other instances that can easily be found, e.g. by just looking at the tickets in here.
Inside of lively one has access to the shell of the server the instance is running on. I think it would be desirable to somehow make this more secure. Probably the potential harm here can be mitigated with some smart setup of users and their permissions, but I think allowing any kind of shell access unauthenticated over the web is undesirable.
Therefore I think it would be good if one could configure the Shell access to be disabled.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.