mirrors/copyparty
1
0
Fork 0
mirror of https://github.com/9001/copyparty.git synced 2025-08-17 09:02:15 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

make it even worse

Browse source
This commit is contained in:
ed 2021-12-27 00:04:38 +01:00
parent 7e139288a6
commit bdad197e2c
1 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
bin/mtag/very-bad-idea.py
View file

@ -1,10 +1,17 @@
#!/usr/bin/env python3 #!/usr/bin/env python3
""" """
use copyparty to xdg-open anything that is posted to it use copyparty to xdg-open anything that is posted to it,
and also xdg-open file uploads
HELLA DANGEROUS,
GIVES RCE TO ANYONE WHO HAVE UPLOAD PERMISSIONS
example copyparty config to use this: example copyparty config to use this:
--urlform save,get -v.::w:c,e2d,e2t,mte=+a1:c,mtp=a1=ad,bin/mtag/very-bad-idea.py --urlform save,get -v.::w:c,e2d,e2t,mte=+a1:c,mtp=a1=ad,bin/mtag/very-bad-idea.py
recommended deps:
apt install xdotool libnotify-bin
""" """
import os import os
@ -14,11 +21,22 @@ from urllib.parse import unquote_to_bytes as unquote
def main(): def main():
with open(os.path.abspath(sys.argv[1]), "rb") as f: fp = os.path.abspath(sys.argv[1])
txt = f.read() with open(fp, "rb") as f:
txt = f.read(4096)
if txt.startswith(b"msg="):
open_post(txt)
else:
open_url(fp)
def open_post(txt):
txt = unquote(txt.replace(b"+", b" ")).decode("utf-8")[4:] txt = unquote(txt.replace(b"+", b" ")).decode("utf-8")[4:]
open_url(txt)
def open_url(txt):
sp.call(["notify-send", "", txt]) sp.call(["notify-send", "", txt])
sp.call(["xdotool", "key", "ctrl+w"]) sp.call(["xdotool", "key", "ctrl+w"])
sp.call(["xdg-open", txt]) sp.call(["xdg-open", txt])