Using this script leads to path traversal vulnerability about officeonlin-install.sh HOT 8 CLOSED

This should be removed from the script on line 588.

--o:storage.filesystem[@allow]=true

only this test will not work anymore.

https://:9980/loleaflet//loleaflet.html?file_path=file:///opt/online/test/data/hello-world.odt

from officeonlin-install.sh.

Hi.
Thank you for reporting this very important issue.
At this point I'm not sure if this vulnerability is implied by the libreoffice online design or
if this this a test feature that should be deactivated either in config or in the build.
This requires more investigations.
Like testing this vulnerability from an external network. And maybe a comparative test with the official collabora docker image.

from officeonlin-install.sh.

@Kassiematis
it's config then, nice !
👍

from officeonlin-install.sh.

Seems to work for us. :)

from officeonlin-install.sh.

Should we change the script? Testing availability can still be done with this link.
https://admin:password@localhost:9980/loleaflet/dist/admin/admin.html

In /opt/online/loolwsd.xml it can still be activated by changing

<storage desc="Backend storage"> <filesystem allow="false" />

to true

For debug/testing purposes only.

from officeonlin-install.sh.

definitively yes but we must find how to remove the prompt showing the test URI or many won't understand why the test instructions are not working.
Https://ip:9980/hosting/discovery is also a good way to test the service availability.

from officeonlin-install.sh.

Prompt can be removed by removing --enable-debug at line 316

lool_configure_opts='--enable-debug'

https://admin:password@localhost:9980/loleaflet/dist/admin/admin.html still works

from officeonlin-install.sh.

Pull requests created,

#97
#98

from officeonlin-install.sh.