Bugs item #482056, was opened at 2001-11-15 04:00
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=103152&aid=482056&group_id=3152
Category: Scripting: Other
Group: aolserver3_3_1
Status: Open
Resolution: None
Priority: 5
Submitted By: Pol Ouilapan (polawat)
Assigned to: Nobody/Anonymous (nobody)
Summary: tcl script can shutdown server
Initial Comment:
A .tcl file containing only the word 'exit' in it can
shutdown the server.
If you put this file anywhere under your web site root
directory and access it with your web browser,
AOLServer will go down.
Is this a hole in the system or is it a mis-
configuration issue?
I'm using AOLserver/3.3.1+ad13.
----------------------------------------------------------------------
>Comment By: Dossy Shiobara (dossy)
Date: 2001-11-15 22:23
Message:
Logged In: YES
user_id=21885
polawat,
Did you do it from where you installed AOLserver, and did
you then restart AOLserver?
Typically, AOLserver gets installed
into /usr/local/aolserver -- you want to basically add the
line "rename exit {}" to the end of the
file /usr/local/aolserver/modules/tcl/init.tcl, and then
restart the nsd process.
-- Dossy
----------------------------------------------------------------------
Comment By: Pol Ouilapan (polawat)
Date: 2001-11-15 21:53
Message:
Logged In: YES
user_id=120476
I tried the rename as suggested, but didn't seem to work.
cat >>modules/tcl/init.tcl <<-EOF
rename exit {}
EOF
----------------------------------------------------------------------
Comment By: Dossy Shiobara (dossy)
Date: 2001-11-15 11:38
Message:
Logged In: YES
user_id=21885
Changing the behavior of exit in nsd core would
be a big disservice. The formation of my AOLserver
testing framework relies on it. ;-)
If you want to avoid people accidentally shutting
your AOLserver down by invoking "exit" by accident,
do this:
cat >>modules/tcl/init.tcl <<-EOF
rename exit _real_exit
EOF
If you want to prevent exit from being invoked
at all, do this:
cat >>modules/tcl/init.tcl <<-EOF
rename exit {}
EOF
IMHO, this is the best solution to this problem.
For people who run public servers, they can "disable"
the exit proc using the second approach. For people
(such as myself) who NEED the exit proc, either the
first approach, or not changing anything at all,
accomodates them.
If what I've suggested here is a reasonable solution,
I think we should close this ticket.
-- Dossy
----------------------------------------------------------------------
Comment By: Scott Goodwin (scottg)
Date: 2001-11-15 08:32
Message:
Logged In: YES
user_id=37651
The last comment posted here wasn't all that helpful; I
think it tends to turn people away from this server and the
community.
Anyway, I pointed out this problem about a year ago in the
nscp module. When I typed 'exit' to close the telnet
session to nscp, the server would shutdown. That was
happening because the Tcl interp that nscp was using did
what I told it -- exited, which took the server with it.
The solution was to create a new exit command that either
did a Ctrl-D for you (which was the proper way to exit
nscp) or a No-Op (I forget which way it was implemented).
I don't think this is really a bug, as you're not supposed
to explicitly exit a Tcl script running in AOLserver.
However, I think it should be fairly easy to replace the
exit command with code that does a No-Op or calls the
normal "close my connection" code.
Thanks for submitting this report,
/s.
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2001-11-15 08:12
Message:
Logged In: NO
"Doctor, it hurts when I do this!"
"Don't do that."
----------------------------------------------------------------------
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=103152&aid=482056&group_id=3152
