bugGNU nano - Bugs: bug #49892, the Execute-Command prompt is...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #49892: the Execute-Command prompt is misleading

Submitter:  Benno Schulenberg <bens>
Submitted:  Tue 20 Dec 2016 10:39:31 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 19 Jan 2017 09:41:43 AM UTC, comment #3: 

Fixed in git, 605f0318.

Benno Schulenberg <bens>
Group administrator
Sun 08 Jan 2017 03:07:06 PM UTC, comment #2: 

Why security hole?  When there is a hello.sh in the current directory and it is executable, I can do ^R ^X ./hello.sh <Enter>, and it will be run.

The thing is: this "[from ./]" seems to suggest that typing the ./ is not needed.  Plus: as an indication of the current directory it is completely useless: it gives zero information.  Instead of being helpful, it is just confusing.

Benno Schulenberg <bens>
Group administrator
Sat 07 Jan 2017 06:19:46 PM UTC, comment #1: 


> To me this suggests that if I type the name of a script located in the current directory, nano will execute that script.


Why would it?  It says what your current working directory is, plain and simple.  It means that if you operate on a file with no path, or with a relative path, the relative path will start here.

Why on earth would it introduce such a blatant security hole as to make executable a file that's not on your PATH?

Anonymous
Tue 20 Dec 2016 10:39:31 AM UTC, original submission:  

To see what I mean, run nano and type ^R ^X.  The prompt now says: "Command to execute [from ./] : ".  To me this suggests that if I type the name of a script located in the current directory, nano will execute that script.  But it doesn't.  If I want it to execute such a script, I have to precede it with a dot and slash: ./name_of_script.

So I think the Execute-Command prompt should just say: "Command to execute : " -- no "from" nor "in" nor anything else added.

Also, at the InsertFile prompt, the "[from ./]" seems superfluos.  It always says "./", never anything else.  Only when using --operatingdir with a dir that is not the current dir, does the "from" say something else.  So maybe this "[from ...]" should only be added when an operatingdir has been specified?

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-24 bens Open/ClosedOpen Closed
    2017-01-19 bens StatusNone Fixed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code