jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Move out ghost file to platformdata

Browse Source 
Since /tmp is world writable this might cause privilege escalation

https://forum.cloudron.io/topic/2222/impersonate-user-privilege-escalation
This commit is contained in:
Girish Ramakrishnan
2020-03-12 10:23:11 -07:00
parent 3e66feb514
commit 6ee4b0da27
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scripts/cloudron-support
View File

@@ -36,8 +36,8 @@ while true; do
--admin-login)
admin_username=$(mysql -NB -uroot -ppassword -e "SELECT username FROM box.users WHERE role='owner' LIMIT 1" 2>/dev/null)
admin_password=$(pwgen -1s 12)
printf '{"%s":"%s"}\n' "${admin_username}" "${admin_password}" > /tmp/cloudron_ghost.json
echo "Login as ${admin_username} / ${admin_password} . Remove /tmp/cloudron_ghost.json when done."
printf '{"%s":"%s"}\n' "${admin_username}" "${admin_password}" > /home/yellowtent/platformdata/cloudron_ghost.json
echo "Login as ${admin_username} / ${admin_password} . Remove /home/yellowtent/platformdata/cloudron_ghost.json when done."
exit 0
;;
--) break;;