Fatal Security Issue

[maltefiala]

If multiple users are logged in on the same server forwarding the same port, files opened via rmate get sent to the user who logged in first.

[sorbits]

If you use rmate with a system that other people login to, you should change the default port and check that setting up the tunnel was succesful before calling ‘rmate’.

While still vulnerable for receiving other peoples’ files, this isn’t something I plan to address, as it is not enabled by default.

You are welcome to submit a pull request that will address the issue. I guess the simplest approach would be to introduce a shared secret that would have to be entered in TextMate and ‘rmate’ would prompt for, if not found among the provided settings.

On May 11, 2013, at 7:14, malte notifications@github.com wrote:

If multiple users are logged in on the same server forwarding the same port, files opened via rmate get sent to the user who logged in first.

—

Reply to this email directly or view it on GitHub.