Skip to content

Fix arbitrary execution via dbus security flaw - #2017

Merged
gsemet merged 1 commit into
Guake:masterfrom
Davidy22:security
Jan 27, 2022
Merged

Fix arbitrary execution via dbus security flaw#2017
gsemet merged 1 commit into
Guake:masterfrom
Davidy22:security

Conversation

@Davidy22

@Davidy22 Davidy22 commented Jan 21, 2022

Copy link
Copy Markdown
Collaborator

Highlighted in and fixes #1796. Also removed comments that won't be true or relevant with this change. These changes orphan the execute_command_by_uuid() method, but the method can probably still be used elsewhere, maybe given a command line flag like what execute_command() has.

Highlighted in Guake#1796. Also removed comments that won't be true or relevant with this change. These changes orphan the execute_command_by_uuid() method, but the method can probably still be used elsewhere.
@Davidy22
Davidy22 requested a review from mlouielu January 21, 2022 04:33
@Davidy22

Copy link
Copy Markdown
Collaborator Author

@gsemet, it really doesn't look like the pull request hook works the way you said it does. Looks a lot to me like CI isn't being run on pull requests.

@gsemet

gsemet commented Jan 22, 2022

Copy link
Copy Markdown
Member

Ok i will check it

@Davidy22

Copy link
Copy Markdown
Collaborator Author

CI didn't run on this because of the issue, but it does pass on the repo this is being made from

@gsemet
gsemet merged commit b769b3a into Guake:master Jan 27, 2022
@Davidy22
Davidy22 deleted the security branch January 27, 2022 06:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security Issue: Exposure of sensitive function, malicious user can arbitrary command via an execute_command d-bus method.

2 participants