CVS edit link for richardp

This module, Shell, provides an emulated web-based shell for drupal sites. It is intended for people who are hosting their sites on a server they do not have shell access to (for example, some of the less-expensive web hosts out there). It will let them type linux/unix commands in a simulated telnet-like window (accomplished through ajax). Most linux/unix commands are available, like patch, wget, rm, cd, etc. The only ones which will not work are those programs or scripts which require interactivity (like emacs, or vim). Because of this, it also includes a simple built-in file editor. So when a user types "vi, vim, or emacs" they get sent to the custom editor instead.

Here is a screenshot of it in action: http://www.richardpeacock.com/dev/files/shell-screenshot1.png

It also has the feature of tab autocomplete, just like on most other shells.

CommentFileSizeAuthor
#11 shell.zip9.23 KBrichardp
#1 shell.zip8.93 KBrichardp

Comments

richardp’s picture

Status: Postponed (maintainer needs more info) » Active
StatusFileSize
new8.93 KB

Here is the download file:

richardp’s picture

Status: Active » Needs review

Sorry-- setting the status to "needs review".

Thanks,
Richard

avpaderno’s picture

Issue tags: +Module review

Hello, and thanks for applying for a CVS account.
I am adding the review tags, and some users (all volunteers) will review the code, pointing out what needs to be changed.

At a glance, the proposed module seems to have a similar purpose of http://drupal.org/project/drush. May you report what is the difference between the proposed module, and the existing one? Why should a user prefer yours rather than Drush? Eventually, why didn't you open a feature request for each feature you think it's missing in Drush?

richardp’s picture

Hello kiamlaluno,

Thank you for checking out the module.

My module does not have a similar purpose as drush. Drush is a command-line utility used to perform operations on drupal, such as installing modules.

My module is a web-based shell, sort of like putty or a telnet client. It can be used to perform almost any operation on the box, not just those having to do with drupal. For example, you can use linux commands like "find", "grep", "wget" and so forth. In fact, you can run drush from my module, if you want. Administrators could use my module, for example, to create new shell scripts, then edit their crontab on the box itself to configure when the script runs.

As I said in my description, this is for users whose web hosts do not give them any kind of shell access. This lets them simulate being able to log into their boxes with putty, for example.

So as you see, this is not similar to drush, so there is no reason try to make a features request for the drush project.

Thanks,
Richard

avpaderno’s picture

My module does not have a similar purpose as drush. Drush is a command-line utility used to perform operations on drupal, such as installing modules.

The purpose of Drush is to execute commands made available from Drush, or any third-party modules that implement the hooks used by Drush. It is possible to execute commands such as find, grep, wget, if a module exposes them as Drush commands.
Using then another module is possible to execute Drush commands without to have shell access.

richardp’s picture

I see. Well, I still believe my module provides a unique feature in that it allows you to issue any valid linux command to the server, and provides an experience similar to that of putty using ajax callbacks and a terminal interface.

With my module, you can run any script on your server, not just what is exposed through Drush. If I understand you correctly, in order for Drush to do all this, I would need to expose all possible linux commands as Drush commands. This seems impossible, given that with my module, you might chose to compile a java program, run a shell script, execute a downloaded program, etc. There is no way for the module to know every possible thing the user wants to do on their box. And such a module seems like it would be getting away from what Drush is all about-- that being the management of your drupal site.

I still feel like this is a unique module, and that its purpose is very different than that of Drush's.

Thanks
Richard

avpaderno’s picture

Status: Needs review » Needs work

A Drush module could accept a command like cli <command> (where <command> is a command that exists in the path). If then the module would be able to list all the available commands that is something more that is not required (in fact, also your module lists the available commands).
The pro of using Drush is that Drush has a set of functions that can be used from the module to output some text, or require input, which should be written from scratch in your module.

As reported in http://drupal.org/cvs-application/requirements, the proposed module must not duplicate work done in existing projects.

richardp’s picture

Status: Needs work » Needs review

I am honestly not trying to be difficult here. I guess I am not explaining myself well enough.

My module is for users who do not have shell access, and are probably using an inexpensive web-host, but, would like to be able to simulate being able to access their site through a shell-like interface. I, myself, am under such a situation.

One of Drush's requirements is: "To use drush from the command line, you'll need a CLI-mode capable PHP binary. The minimum PHP version is 5.2."

If the user has no control over the state of their PHP binary, or has an older version of PHP, then they cannot use Drush. But they *can* use my module.

But beside from all that, my module simply has a different function than Drush.

The only similarity I can see between my module and Drush is that they both have the word "shell" in the title. My module is not simply faking commands. When you type "shelp" in my module, yes, you get a couple of commands that it does differently than expected — but — any linux command or script or program will work without me having to program anything extra

I am honestly not trying to be rude, but you keep insisting that I am duplicating the features of Drush, but I am not, at all. The two modules serve two very different functions. And, again, my module is for people who have no access to a shell, making it unlikely they could even get Drush installed in the first place.

Please do not just give up on my project because I am not explaining it well enough.

Richard

[Edited by kiamlaluno to remove the excessive use of &lt,strong> tags]

richardp’s picture

To clarify something:

You want me to make it so that my module requires Drush to be installed, and passes all linux commands through Drush. The reason I can't do this is because it would severely limit the usefulness of my application. Remember, my application is for users who do not have shell access.

From the Drush readme.txt file:

"1. Untar the tarball into a folder outside of your web site." - If you are on a low-cost web host, with no shell access, you probably cannot do this.

"3. (Optional, but recommended:) To ease the use of drush,
- create a link to drush in a directory that is in your $PATH, e.g.:
$ ln -s /path/to/drush/drush /usr/local/bin/drush
OR
- create an alias to drush:
$ alias drush='/path/to/drush/drush'
"
— again, if you do not have shell access, or are on a cheap web host where your access is limited, you probably cannot perform these actions at all.

So you see what I mean? I do not want to require Drush, because I don't see it as adding anything useful to my module — only making it so that the intended users can't use it!

The irony is that if a user did have my module installed, then, using it, they could probably install Drush and create the links and aliases. But if all you have to work with is cpanel or less, then you just can't.

This is why I don't understand why you keep insisting I should use Drush. They just aren't the same thing and it doesn't make sense to try to force my module to pass commands through Drush.

I don't mean to just argue. I just don't think my module overlaps with Drush at all.

[Edited by kiamlaluno to remove the <strong> tags]

avpaderno’s picture

Status: Needs review » Needs work

See http://drupal.org/coding-standards to understand how a module should be written. In particular, see how the code should be formatted (in example the curly bracket should always be put after a IF-statement, and should be in the same line), and which string functions the module is supposed to use.

richardp’s picture

Status: Needs work » Needs review
StatusFileSize
new9.23 KB

Thank you for taking another look at my module. Sorry about the delay-- I was out of town.

I have fixed the curly brackets, and used the drupal string functions found here: http://open.madcap.nl/fotd/drupal-string-functions where appropriate. I have also tried to make sure that I used t() where appropriate.

I am attaching my updated code now.

Thanks again,
Richard

richardp’s picture

So-- what happens now? Do I need to do something further? It has been almost 2 weeks since I posted my updated code.

avpaderno’s picture

Status: Needs review » Fixed

Thank you for your contribution! I am going to update your account.
These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

richardp’s picture

That's okay. Thanks for putting up with me!

Richard

heine’s picture

The module takes actions on GET requests without verifying that the request originated with user intent. In other words: it is vulnerable to Cross Site Request Forgeries.

The module should only execute commands after checking a session-specific token. (drupal_get_token, drupal_valid_token or acting in a FAPI submit handler).

richardp’s picture

You're absolutely right, Heine. As soon as the project page went up (http://drupal.org/project/shell), I was contacted by the security team to tell me just that. It is fixed now in the beta version on that page. Thanks for the input!

Status: Fixed » Closed (fixed)
Issue tags: -Module review

Automatically closed -- issue fixed for 2 weeks with no activity.

avpaderno’s picture

Component: Miscellaneous » new project application
Assigned: Unassigned » avpaderno
Issue summary: View changes