bugGNU nano - Bugs: bug #49892, the Execute-Command prompt is...

 
 

bug #49892: the Execute-Command prompt is misleading

Submitted by:  Benno Schulenberg <bens>
Submitted on:  Tue 20 Dec 2016 10:39:31 AM UTC  
 
Severity: 3 - NormalStatus: Fixed
Assigned to: Benno Schulenberg <bens>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 19 Jan 2017 09:41:43 AM UTC, comment #3:

Fixed in git, 605f0318.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Sun 08 Jan 2017 03:07:06 PM UTC, comment #2:

Why security hole? When there is a hello.sh in the current directory and it is executable, I can do ^R ^X ./hello.sh <Enter>, and it will be run.

The thing is: this "[from ./]" seems to suggest that typing the ./ is not needed. Plus: as an indication of the current directory it is completely useless: it gives zero information. Instead of being helpful, it is just confusing.

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Sat 07 Jan 2017 06:19:46 PM UTC, comment #1:

> To me this suggests that if I type the name of a script located in the current directory, nano will execute that script.


Why would it? It says what your current working directory is, plain and simple. It means that if you operate on a file with no path, or with a relative path, the relative path will start here.

Why on earth would it introduce such a blatant security hole as to make executable a file that's not on your PATH?

Anonymous
Tue 20 Dec 2016 10:39:31 AM UTC, original submission:

To see what I mean, run nano and type ^R ^X. The prompt now says: "Command to execute [from ./] : ". To me this suggests that if I type the name of a script located in the current directory, nano will execute that script. But it doesn't. If I want it to execute such a script, I have to precede it with a dot and slash: ./name_of_script.

So I think the Execute-Command prompt should just say: "Command to execute : " -- no "from" nor "in" nor anything else added.

Also, at the InsertFile prompt, the "[from ./]" seems superfluos. It always says "./", never anything else. Only when using --operatingdir with a dir that is not the current dir, does the "from" say something else. So maybe this "[from ...]" should only be added when an operatingdir has been specified?

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bens (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 24 Feb 2017 10:17:58 AM UTCbensOpen/ClosedOpen=>Closed
    Thu 19 Jan 2017 09:41:43 AM UTCbensStatusNone=>Fixed

    Back to the top


    Powered by Savane 3.1-cleanup1