itsscb/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2025-06-30 05:02:59 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

fix: check exact match on command allow list

Browse Source
This commit is contained in:
Henrique Dias 2025-06-26 15:19:13 +02:00
parent b0f92dd2d7
commit e2e1e49130
No known key found for this signature in database
2 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
runner/parser.go
View File

@ -8,7 +8,7 @@ import (
// ParseCommand parses the command taking in account if the current // ParseCommand parses the command taking in account if the current
// instance uses a shell to run the commands or just calls the binary // instance uses a shell to run the commands or just calls the binary
// directyly. // directly.
func ParseCommand(s *settings.Settings, raw string) ([]string, error) { func ParseCommand(s *settings.Settings, raw string) ([]string, error) {
var command []string var command []string

10
users/users.go
View File

@ -2,7 +2,7 @@ package users
import ( import (
"path/filepath" "path/filepath"
"regexp" "slices"
"github.com/spf13/afero" "github.com/spf13/afero"
@ -111,11 +111,5 @@ func (u *User) CanExecute(command string) bool {
return false return false
} }
for _, cmd := range u.Commands { return slices.Contains(u.Commands, command)
if regexp.MustCompile(cmd).MatchString(command) {
return true
}
}
return false
} }