Page MenuHomePhabricator
Create Task
Maniphest T182747

vips binary should have shell restrictions applied
Closed, ResolvedPublic
Actions

Description

The vips binary should have shell restrictions applied to it. See https://www.mediawiki.org/wiki/Manual:Shell_framework#Restrictions for details on what needs to change.

Related Objects
Search...

Event Timeline

Legoktm triaged this task as Medium priority.Dec 13 2017, 2:27 AM
Legoktm created this task.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 13 2017, 2:27 AM
Legoktm added a comment.Dec 13 2017, 2:28 AM

VipsScaler also shells out to exiv2, which should also be restricted.

Legoktm mentioned this in T172584: Securing external binaries run by MediaWiki.Dec 13 2017, 2:33 AM
xSavitar closed this task as Resolved.Jan 31 2019, 6:45 PM
xSavitar claimed this task.
xSavitar added a subscriber: xSavitar.

Seems this has handled this bug already: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/VipsScaler/+/384430. Marking as resolved!

Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL