Commit graph

11 commits

Author SHA1 Message Date
KLuka
4aa0eb97e4 Disable HTTP fallback via "/plain" URL (CVE-2015-8400)
* Disabled all methods of HTTP fallback when HTTPS is enabled. This
  is enforced on server side so that even modified client code (JS)
  can not redirect client from HTTPS to HTTP, like it was possible
  before (issue #355).
* Current solution unfortunately also disables automatic upgrade from
  HTTP to HTTPS (when available), since all non-SSL connections are
  droped immediately.
2015-12-03 17:47:26 +01:00
KLuka
883b7aa7f0 Real IP recognition over proxy (partial fix #54)
* Recogniton of HTTP header field 'X-Real-IP' was added. Value
  is used in LOGIN service with peer name as remote host identifier.
  This was we are able to see real IP in login related log files
  such as /var/log/auth.log, etc...
* Real IP, peer name and URL are also passed to launched  service
  as environment variables (SHELLINABOX_PEERNAME, SHELLINABOX_REALIP
  and SHELLINABOX_URL). This can be used by custom user service shell
  scripts or programs.
* Real IP can also be passed to custom user service as command line
  parameter ${realip}.
2015-05-17 20:05:15 +02:00
zodiac@gmail.com
1a33fc8127 The server could sometimes end up listening for events even though it
was not really interested in them. This could result in inefficient I/O
behavior and most noticably it broke the ability to interrupt long running
output with CTRL-C.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@238 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-10-02 23:40:24 +00:00
zodiac@gmail.com
9b0a937e35 Started working on support for WebSockets.
Fixed some compiler warnings when compiling with -Wextra

Thanks to Jan Jaeger's excellent bug report, made some changes
that should make it easier to build ShellInABox for OpenWRT.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@202 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-03-29 16:40:17 +00:00
zodiac
bb4dbaa5f5 Making it easier to host the terminal on non-root URLs by always redirecting to a URL that includes a trailing slash.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@140 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-07-06 16:27:11 +00:00
zodiac@gmail.com
5ec8c4c19b Added new "--localhost-only" command line option.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@125 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-06-21 19:55:20 +00:00
zodiac
11d1a710f2 Work-around for compilers that turn on "-Wformat=2" by default. This is an
ill-advised choice, as this particular compiler options has a tendency to
generate a lot of false positives.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@62 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-02-15 20:01:53 +00:00
zodiac
e40a555cbf Allow SSL certificate and key to be passed in through a file handle.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@46 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-01-17 03:37:20 +00:00
zodiac
046a9305c9 Updated copyright notice.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@25 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-01-02 06:09:13 +00:00
zodiac
35aa1a7881 - Tightened setuid operation to not allow any user or group changes.
- Added support for --cgi mode.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@22 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-01-01 05:53:04 +00:00
zodiac
aab20f5ed0 First public release of the version 2.0 rewrite. This is the
first release of ShellInABox that supports an AJAX interface
instead of the original Java applet.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@2 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2008-12-29 23:57:07 +00:00