Other User ID's and Names visible on the Server

[Bernd Dietzel]

prove :
on the ubuntu software center test a terminal appication and connect to the weblive server.

in the terminal type in :

gnome-panel

now you have the complete ubuntu desktop

navigate to users and groups and find the other users id's with their Names

or navigate with nautilus to the /home directory.

should be not visible in my opinion.

please fix it :-)

Video from me to show how to get the complete Desktop (german language)
http://www.youtube.com/watch?v=YH88E9kMXgo

[Stéphane Graber (stgraber)]

Hi,

The fact that you can start a full desktop isn't a bug, it's a feature of WebLive.
You can easily access the feature at: http://www.edubuntu.org/weblive

Indeed the server is shared with many concurrent users, in some cases the users are moved to containers but it's not done systematically yet as there still are a few bugs and it's using quite a bit of disk space to do so.

I did a quick check and you can't read another user's files in their home directory though in some cases sessions fail to cleanup properly, leaving extra entries in /home (cleaned up daily). In such case, if you get the same uid as a previous deleted user, you'll be able to access their home directory.

In the future, WebLive might switch to a model where it uses containers for all sessions, then it'll be quite easy to avoid users from seeing each other at all, but it's not a very high priority task yet.

Thanks for the bug report!

[Bernd Dietzel (1-launchpad-net-theregrunner-com)]

Many thanks for checking it.
I was afraid that somone patches weblive python script to get the other users ID to access their Webbrowser Passwords or something.

Greetings from germany and keep on the good work ;-)
Bernd