[Freeciv-Dev] Re: Background Freeciv Server

[Reinier Post <rp@xxxxxxxxxx>]

On Wed, Aug 23, 2000 at 01:03:47AM +0200, Erik Sigra wrote:

> > > * No need for using 'civserver -r script'. A shell script would do.
> > > Civserver scripting could be done as shell scripting.
> > 
> > Aargh!  There goes security.  This seems a fatal drawback to me.
> 
> For example what harm could be done with a shell script that can not be
> done now?

The problem is, you'd depend on the shell to do those things, which means
it's only safe to allow it to those who have shell access on the machine
already.  As it is now, civservers can be attached to a telnet session.
I know this use isn't at all typical.

> > But what about client side server commands?
> 
> What would be the problem with them? Aren't they recieved in packets by
> the server. If so the server can just interpret then just like it would
> interpret anything ater 'civserver' at the bash prompt, no?

OK, that would mean the clients would not have access to bash.
In that case it's still safe.

Another thing I'm wondering about is implementation.  How would the
civserver command communicate its commands to the server?  The server
will need to listen to a port.  One idea is to use a special client.
Another is to open a two-way piped communication line to the existing
civserver command line interface.  Both ideas are basically add-ons:
they can be implemented as special programs that interface with the
existing civserver; the existing civserver code wouldn't be affected.
That is a good idea.  I would be opposed to *replacing* the existing
command line interface with something shell-based.

-- 
Reinier