Screen change script argument#249
Conversation
|
So, if I understand, this allows barrier to execute arbitrary code upon the condition of screen change? |
|
Yup, that's correct |
| cmd += info->m_screen; | ||
| cmd += " &"; | ||
|
|
||
| system(cmd.c_str()); |
There was a problem hiding this comment.
This is C++ code, use std::system.
|
I don't know how I feel about allowing barrier to execute arbitrary code. What is your opinion @p12tic ? |
|
It's running a user provided script with user configured screen names so it shouldn't be a security issue if that's your concern. Also since it's only available as a command line argument it's available only to users that run barriers manually so they should know what they're doing :) |
|
I agree with @vorph1. If attacker has access to command line arguments he already can do whatever he wants. Looking from this side, there's one issue though. |
|
It's not like barrier runs in a privileged mode anyway |
|
This would add a Qt dependency for the sever app. |
|
You could use execl() instead of system(). |
|
Hm, execl() is linux-only. Maybe something from https://www.boost.org/doc/libs/1_64_0/doc/html/process.html would be a better cross-platform option. |
|
execl() is part of POSIX. |
|
OK, I missed the part that this is linux-only. Looks good then. |
|
Ready to be merged then? |
|
Yes, let's do it. |
Added a new server cli argument
--screen-change-scriptthat is invoked with the screen name as the first parameter.My main use case for barrier is for VMs with GPU passthrough so I use this to switch my monitor input ie.
This is for linux server only.