Files @ fa3365c94064
Branch filter:

Location: kallithea/init.d/kallithea-daemon-gentoo

Mads Kiilerich
repos: introduce low level check of clone URIs to prevent direct file system access to local repos

This is already checked in web form validation, but also check at low level to
make sure API access enforce the same invariants.

This issue was found and reported by
Kacper Szurek
https://security.szurek.pl/
#!/sbin/runscript
########################################
#### THIS IS AN GENTOO INIT.D SCRIPT####
########################################

APP_NAME="kallithea"
APP_HOMEDIR="username/python_workspace"
APP_PATH="/home/$APP_HOMEDIR/$APP_NAME"

CONF_NAME="production.ini"

PID_PATH="$APP_PATH/$APP_NAME.pid"
LOG_PATH="$APP_PATH/$APP_NAME.log"

PYTHON_PATH="/home/$APP_HOMEDIR/v-env"

RUN_AS="username"

DAEMON="$PYTHON_PATH/bin/paster"

DAEMON_OPTS="serve --daemon \
--user=$RUN_AS \
--group=$RUN_AS \
--pid-file=$PID_PATH \
--log-file=$LOG_PATH  $APP_PATH/$CONF_NAME"

#extra options
opts="${opts} restartdelay"

depend() {
    need nginx
}

start() {
    ebegin "Starting $APP_NAME"
    start-stop-daemon -d $APP_PATH -e PYTHON_EGG_CACHE="/tmp" \
        --start --quiet \
        --pidfile $PID_PATH \
        --user $RUN_AS \
        --exec $DAEMON -- $DAEMON_OPTS
    eend $?
}

stop() {
    ebegin "Stopping $APP_NAME"
    start-stop-daemon -d $APP_PATH \
        --stop --quiet \
        --pidfile $PID_PATH || echo "$APP_NAME - Not running!"
    if [ -f $PID_PATH ]; then
        rm $PID_PATH
    fi
    eend $?
}

restartdelay() {
    #stop()
    echo "sleep3"
    sleep 3
    
    #start()
}