diff --git a/bashbot.sh b/bashbot.sh index af83107..4342a0b 100755 --- a/bashbot.sh +++ b/bashbot.sh @@ -12,7 +12,7 @@ # This file is public domain in the USA and all free countries. # Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying) # -#### $$VERSION$$ v0.80-pre-2-g9482bd6 +#### $$VERSION$$ v0.80-pre-3-g3c5ffdb # # Exit Codes: # - 0 sucess (hopefully) @@ -141,7 +141,7 @@ procname(){ # $1 proc name proclist() { # shellcheck disable=SC2009 - ps -ef | grep -v grep| grep "$1" | sed 's/\s\+/\t/g' | cut -f 2 + ps -fu "${UID}" | grep -v grep| grep "$1" | sed 's/\s\+/\t/g' | cut -f 2 } # returns true if command exist @@ -392,10 +392,6 @@ bot_init() { local OLDTMP="${BASHBOT_VAR:-.}/tmp-bot-bash" [ -d "${OLDTMP}" ] && { mv -n "${OLDTMP}/"* "${TMPDIR}"; rmdir "${OLDTMP}"; } [ -f "modules/inline.sh" ] && rm -f "modules/inline.sh" - # shellcheck disable=SC2009 - oldbot="$(ps -ef | grep startbot | grep -v -e 'grep' -e '\-startbot' )" - [ "${oldbot}" != "" ] && \ - echo -e "${ORANGE}Warning: At least one not upgraded TMUX bot is running! It is not possible to stop it by this script:${NC}\\n${oldbot}" #setup bashbot [[ "${UID}" -eq "0" ]] && RUNUSER="nobody" echo -n "Enter User to run basbot [$RUNUSER]: " @@ -405,6 +401,10 @@ bot_init() { echo -e "${RED}User \"$TOUSER\" not found!${NC}" exit 3 else + # shellcheck disable=SC2009 + oldbot="$(ps -fu "$TOUSER" | grep startbot | grep -v -e 'grep' -e '\-startbot' )" + [ "${oldbot}" != "" ] && \ + echo -e "${ORANGE}Warning: At least one not upgraded TMUX bot is running! You must stop it with kill command:${NC}\\n${oldbot}" echo "Adjusting user \"${TOUSER}\" files and permissions ..." [ -w "bashbot.rc" ] && sed -i '/^[# ]*runas=/ s/runas=.*$/runas="'$TOUSER'"/' "bashbot.rc" chown -R "$TOUSER" . ./* diff --git a/modules/background.sh b/modules/background.sh index d48e9de..e0053ef 100644 --- a/modules/background.sh +++ b/modules/background.sh @@ -5,7 +5,7 @@ # This file is public domain in the USA and all free countries. # Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying) # -#### $$VERSION$$ v0.80-pre-2-g9482bd6 +#### $$VERSION$$ v0.80-pre-3-g3c5ffdb # source from commands.sh if you want ro use interactive or background jobs @@ -52,10 +52,8 @@ start_proc() { local fifo; fifo="${TMPDIR:-.}/$(procname "$1" "$3")" kill_proc "$1" "$3" mkfifo "${fifo}" - nohup bash &>>"${fifo}.log" <>"${fifo}.log" & } diff --git a/modules/sendMessage.sh b/modules/sendMessage.sh index d34a5e5..b45547e 100644 --- a/modules/sendMessage.sh +++ b/modules/sendMessage.sh @@ -5,7 +5,7 @@ # This file is public domain in the USA and all free countries. # Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying) # -#### $$VERSION$$ v0.80-pre-0-gdd7c66d +#### $$VERSION$$ v0.80-pre-3-g3c5ffdb # source from commands.sh to use the sendMessage functions @@ -88,18 +88,18 @@ send_button() { UPLOADDIR="${BASHBOT_UPLOAD:-${TMPDIR}/upload}" send_file() { - [ "$2" = "" ] && return - local file="$2" + [ "$2" = "" ] && return 0 + local CUR_URL WHAT STATUS file="$2" local CAPTION=',"caption":"'$3'"'; [ "$3" = "" ] && CAPTION="" # file access checks ... - [[ "$file" = *'..'* ]] && return # no directory traversal - [[ "$file" = '.'* ]] && return # no hidden or relative files + [[ "$file" = *'..'* ]] && return # no directory traversal + [[ "$file" = '.'* ]] && return # no hidden or relative files if [[ "$file" = '/'* ]] ; then - [[ "$file" =~ $FILE_REGEX ]] || return # absulute must match REGEX + [[ ! "$file" =~ $FILE_REGEX ]] && return # absulute must match REGEX else file="${UPLOADDIR:-NOUPLOADDIR}/${file}" # othiers must be in UPLOADDIR fi - [ -r "$file" ] || return # and file must exits of course + [ ! -r "$file" ] && return # and file must exits of course local ext="${file##*.}" case $ext in diff --git a/test/d-send_message-test.sh b/test/d-send_message-test.sh index f4938b8..d5705d2 100755 --- a/test/d-send_message-test.sh +++ b/test/d-send_message-test.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -#### $$VERSION$$ v0.80-pre-0-gdd7c66d +#### $$VERSION$$ v0.80-pre-3-g3c5ffdb # include common functions and definitions # shellcheck source=test/ALL-tests.inc.sh @@ -33,10 +33,21 @@ sendJson() { echo -n " Send line ..." +# create dummy files for upload +ALLOW='/tmp/allowed' +FILE_REGEX="$ALLOW/.*" +[ -d "$ALLOW" ] || mkdir "$ALLOW" +touch "$ALLOW/this_is_my.gif" "$ALLOW/this_is_my.doc" +touch "$TMPDIR/this_is_my.gif" "$TMPDIR/this_is_my.doc" + while read -r line ; do echo -n "." + set -x send_message "123456" "$line" >>"${OUTPUTFILE}" -done < "${INPUTFILE}" #2>>"${LOGFILE}" + set +x +done < "${INPUTFILE}" 2>>"${LOGFILE}" +[ -d "$ALLOW" ] && rm -rf "$ALLOW" + echo " done." { diff -c "${REFFILE}" "${OUTPUTFILE}" || exit 1; } | cat -v diff --git a/test/d-send_message-test/d-send_message-test.input b/test/d-send_message-test/d-send_message-test.input index 1c17d70..b054070 100644 --- a/test/d-send_message-test/d-send_message-test.input +++ b/test/d-send_message-test/d-send_message-test.input @@ -14,3 +14,13 @@ Text plus vuene will appear in chat mylatstartshere la10 mylongstartshere lo20 m # test for new inline button Text plus keyboard will appear in chat mybtextstartshere Button Text myburlstartshere https://www... STABILO 88/240 Fineliner point 88 mynewlinestartshere mynewlinestartshere [https://images-na.ssl-images-amazon.com/images/I/41oypA3kmHL.l_SX300.jpg] mynewlinestartshere mybtextstartshere Bei Amazon ansehen ... myburlstartshere https://www.amazon.de/dp/B014TN3JYW mytextstartshere second part of text mynewlinestartshere plus newline. + +# test for sendfile +Text plus absolute file will appear in chat myfilelocationstartshere /tmp/allowed/this_is_my.gif +Text plus absolute file will appear in chat myfilelocationstartshere /tmp/allowed/this_is_my.doc +Text plus relative file will appear in chat myfilelocationstartshere this_is_my.gif +Text plus relative file will appear in chat myfilelocationstartshere this_is_my.doc +THIS IS OUTSIDE allowed myfilelocationstartshere /home/user/NOTallowed/this_is_my.dif +THIS DOES NOT EXIST myfilelocationstartshere /tmp/allowed/this_does_not_exist.gif +THIS DOES NOT EXIST myfilelocationstartshere this_does_not_exist.gif + diff --git a/test/d-send_message-test/d-send_message-test.result b/test/d-send_message-test/d-send_message-test.result index c0dfa66..96b38cb 100644 --- a/test/d-send_message-test/d-send_message-test.result +++ b/test/d-send_message-test/d-send_message-test.result @@ -47,3 +47,18 @@ second part of text plus newline.", "reply_markup": {"inline_keyboard": [ [ {"text":"Bei Amazon ansehen ...", "url":"https://www.amazon.de/dp/B014TN3JYW"}] ]} URL:https://api.telegram.org/botbashbottestscript/sendMessage +chat:123456 JSON:"text":"# test for sendfile" +URL:https://api.telegram.org/botbashbottestscript/sendMessage + +chat:123456 JSON:"action": "upload_photo" +URL:https://api.telegram.org/botbashbottestscript/sendChatAction + +chat:123456 JSON:"photo":"/tmp/allowed/this_is_my.gif","caption":"Text plus absolute file will appear in chat"" +URL:https://api.telegram.org/botbashbottestscript/sendPhoto + +chat:123456 JSON:"action": "upload_document" +URL:https://api.telegram.org/botbashbottestscript/sendChatAction + +chat:123456 JSON:"document":"/tmp/allowed/this_is_my.doc","caption":"Text plus absolute file will appear in chat"" +URL:https://api.telegram.org/botbashbottestscript/sendDocument +