Description: The cmd ioslave is a simple tool which executes a command in bash while capturing its output. Entering "cmd:date" in the location bar of konqueror would thus display the date. More complex commands using pipes and perl one-liners may also be used.Last changelog:
The cmd ioslave should ALWAYS be read-only on files.
This would avoid any security risk, any created/modified files should be made on /tmp.
Again, we don't want ActiveX nightmare inside webpage for KDE users using cmd ioslave.
For instance, remembers me, webpage forcing people to turn on ActiveX, Java, JavaScript and install spyware...
else the website is not display!
Having cmd ioslave with a default read-only that can be turn to Read-write would result in some webpage forcing people to have read-write to view the page or accept a message box prompt recursively ala ActiveX.
e.g.
You must Accept this message.
Allow read-write cmd ioslave?
Yes No
No -> Force a loop... until user press Yes.
Another way would be to have cmd ioslave to be run EXCLUSIVELY as another user, like cmd_nobody:cmd_nobody on /tmp.
This would means that only world read accessible files could be read/parse, etc.
Fred.
Commands are not directly executed, you'll get a messgebox that asks what you want to do. (and shows the command)
Anyway, beginners really shouldn't use this. (as a redirection would be even worse)
Hmm... hmm... this indeed contains big potential danger. Users tend to "click away" are-you-sure message boxes...
Is it possible to allow only local resources to use this ioslave?
Otherwise its a potential security risk to use it, IMO.
Even if it would be possible to not accept for instance links from web pages, this would remain a security risk and not appropriate for most users.
Entering something into the location bar of your browser should IMO not be able to result in your home partition being erased, warning or no warning. So this should really only be used by those understanding the risk taken.
Hi, I'm using KDE 3.2 and tried to install the ioslave:
meyerm@yavin cmd $ make
cd . && /bin/sh /usr/local/src/Programme/cmd-ioslave/cmd/admin/missing --run aclocal-1.7
cd . && \
/bin/sh /usr/local/src/Programme/cmd-ioslave/cmd/admin/missing --run automake-1.7 --gnu Makefile
Can't locate object method "path" via package "Request" at /usr/share/autoconf/Autom4te/C4che.pm line 69, line 111.
configure.in: no proper invocation of AM_INIT_AUTOMAKE was found.
configure.in: You should verify that configure.in invokes AM_INIT_AUTOMAKE,
configure.in: that aclocal.m4 is present in the top-level directory,
configure.in: and that aclocal.m4 was recently regenerated (using aclocal).
configure.in: required file `./install-sh' not found
configure.in: required file `./mkinstalldirs' not found
configure.in: required file `./missing' not found
SUBDIRS: variable `TOPSUBDIRS' is used but `TOPSUBDIRS' is undefined
make: *** [Makefile.in] Error 1
Ratings & Comments
9 Comments
are you still working on this? I think its kind'a cool, at least I like it... maybe you can get it in KDE-extragear or something like that?!?!?
The cmd ioslave should ALWAYS be read-only on files. This would avoid any security risk, any created/modified files should be made on /tmp. Again, we don't want ActiveX nightmare inside webpage for KDE users using cmd ioslave. For instance, remembers me, webpage forcing people to turn on ActiveX, Java, JavaScript and install spyware... else the website is not display! Having cmd ioslave with a default read-only that can be turn to Read-write would result in some webpage forcing people to have read-write to view the page or accept a message box prompt recursively ala ActiveX. e.g. You must Accept this message. Allow read-write cmd ioslave? Yes No No -> Force a loop... until user press Yes. Another way would be to have cmd ioslave to be run EXCLUSIVELY as another user, like cmd_nobody:cmd_nobody on /tmp. This would means that only world read accessible files could be read/parse, etc. Fred.
e.g. http://www.test.test/test.html: <a href="cmd: rm -rf ~">click me (not really!)</a> keep careful;-)
Commands are not directly executed, you'll get a messgebox that asks what you want to do. (and shows the command) Anyway, beginners really shouldn't use this. (as a redirection would be even worse)
Hmm... hmm... this indeed contains big potential danger. Users tend to "click away" are-you-sure message boxes... Is it possible to allow only local resources to use this ioslave? Otherwise its a potential security risk to use it, IMO.
Even if it would be possible to not accept for instance links from web pages, this would remain a security risk and not appropriate for most users. Entering something into the location bar of your browser should IMO not be able to result in your home partition being erased, warning or no warning. So this should really only be used by those understanding the risk taken.
YES!!! cdparanoia 1 - | lame - 1.mp3 --alt-preset standard I assume, working dir is ~ ?
Hi, I'm using KDE 3.2 and tried to install the ioslave: meyerm@yavin cmd $ make cd . && /bin/sh /usr/local/src/Programme/cmd-ioslave/cmd/admin/missing --run aclocal-1.7 cd . && \ /bin/sh /usr/local/src/Programme/cmd-ioslave/cmd/admin/missing --run automake-1.7 --gnu Makefile Can't locate object method "path" via package "Request" at /usr/share/autoconf/Autom4te/C4che.pm line 69, line 111. configure.in: no proper invocation of AM_INIT_AUTOMAKE was found. configure.in: You should verify that configure.in invokes AM_INIT_AUTOMAKE, configure.in: that aclocal.m4 is present in the top-level directory, configure.in: and that aclocal.m4 was recently regenerated (using aclocal). configure.in: required file `./install-sh' not found configure.in: required file `./mkinstalldirs' not found configure.in: required file `./missing' not found SUBDIRS: variable `TOPSUBDIRS' is used but `TOPSUBDIRS' is undefined make: *** [Makefile.in] Error 1
Sorrry about that. I have added the missing file aclocal.m4, so it should work now.