X2Go Bug report logs - #1600
Filter ACPI events

version graph

Package: x2goserver; Maintainer for x2goserver is X2Go Developers <x2go-dev@lists.x2go.org>; Source for x2goserver is src:x2goserver.

Reported by: Yetoo <yetoohappy@gmail.com>

Date: Tue, 25 Apr 2023 17:30:01 UTC

Severity: critical

Found in version 4.1.0.3-5

Full log

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

Received: (at submit) by bugs.x2go.org; 25 Apr 2023 17:28:30 +0000
From yetoohappy@gmail.com  Tue Apr 25 19:28:27 2023
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-0.1 required=3.0 tests=BAYES_40,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,SPF_HELO_NONE,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2
Received: from mail-ed1-x530.google.com (mail-ed1-x530.google.com [IPv6:2a00:1450:4864:20::530])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id C94925DA21
	for <submit@bugs.x2go.org>; Tue, 25 Apr 2023 19:28:26 +0200 (CEST)
Received: by mail-ed1-x530.google.com with SMTP id 4fb4d7f45d1cf-5050491cb04so9121231a12.0
        for <submit@bugs.x2go.org>; Tue, 25 Apr 2023 10:28:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20221208; t=1682443706; x=1685035706;
        h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
         :date:message-id:reply-to;
        bh=JoM80wW5UrIqPf6JuHPCVfamOvHWwwjsVeoKYNKI694=;
        b=rluPA2GnDcfTAuYtwWvPVyp58SyjUJoJNxjLmFCpFdM6+BPVJT1ajy6K6aHVNqTsUc
         7Sj2ulO/8pENM37556sD1f/ieWTXwHL6narHEmArtlRuz86sU4CYhum4REDTfBIgEeGB
         DhYKyEF6D5qJP5eC1BHIQIbzwE3dEdn5BMfCqwCsoa9bKLvqeDfO0zqImny+yNxAcU+O
         iU/nbpvCQWWq3ZBmP8WmCaurzDWPTph+V09p0EUQY5RRogSz2SCx0aJ8qdI7qh0dSnMs
         huHBJUOorY0BijDIUFSO2kM36fSPaNMrgkvet6o+5PQ65UmUXKFNOVL1jdpA9b3Jp/UM
         4mdw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20221208; t=1682443706; x=1685035706;
        h=to:subject:message-id:date:from:mime-version:x-gm-message-state
         :from:to:cc:subject:date:message-id:reply-to;
        bh=JoM80wW5UrIqPf6JuHPCVfamOvHWwwjsVeoKYNKI694=;
        b=HuTk+/qxS2HlYMvtvvR3YMPIJfD0E2bGS/SpP4WhYns4FVDFiPnmzOFLT50OsKvGah
         eT9nENebv8daBS++JXdKv9LR2X7HJohUC6oMylm2J07tkpUSzIRu11iJOxGPLw7ivR1Y
         N4KJEx4CtWoL61AfPdbYIJ/q62rkjoeMl4MF7ghO9veMtaKbXd7yg80Nn6vdi1+TVYpD
         kMHMclayU1SbyOInilznvku6ZePv2RqFAGkVesELUGvjG1OHd//401zoaiwB4Jc8mkkh
         K0VJ7IiG/ee8vBxPzC6/Y3vM2rBQFlraiWnt+rqnIMweuawqCqiRHTKy09aQNj1m+eXa
         xvJw==
X-Gm-Message-State: AAQBX9cwGjhY7X/hSnspz9NPbU59L5+b9xf2jmlatmNmOv9aV5zBplAs
	cYxG3rR6+thP3dLlampQC4zEa4ZX8f9hov4TWm8KPhaWTD0=
X-Google-Smtp-Source: AKy350bO2GHgf8Nwlxj0pkTDnvli0MSwOlfpAqUlRLZUAbu74m5WYweOEPWJYtTeezNpNq51FS/exgyTRhIqK7L9Buo=
X-Received: by 2002:aa7:df0d:0:b0:506:9984:9239 with SMTP id
 c13-20020aa7df0d000000b0050699849239mr14661374edy.26.1682443705973; Tue, 25
 Apr 2023 10:28:25 -0700 (PDT)
MIME-Version: 1.0
From: Yetoo <yetoohappy@gmail.com>
Date: Tue, 25 Apr 2023 10:28:14 -0700
Message-ID: <CALT2f4t+acJeMk=MfjbEohU6zwxMJhKXFpfYqi-5QT8jinC6zw@mail.gmail.com>
Subject: Filter ACPI events
To: submit@bugs.x2go.org
Content-Type: text/plain; charset="UTF-8"

Package: x2goserver
Version: 4.1.0.3-5
Severity: Critical

I have x2goclient installed on local Fedora 37 machine and
x2goserver/x2godesktopsharing installed on remote Debian 11 and
(different) Fedora 37 machines. On the Fedora 37 local machine I
connected to the Fedora 37 remote machine in X2go/X11 Desktop Sharing
mode with fullscreen and press the power button on the local machine.
This causes the Fedora 37 remote machine to respond to the shutdown
command as configured and, in this instance, shutdown. I tested with a
Debian 11 remote machine with x2goserver/x2godesktopsharing installed
on it and it too responded to the shutdown acpi command. Both remote
machines have xfce4 desktop installed.

I expect the server to at least discard ACPI events and not depend on
a client to not send ACPI events. For thin client users expecting the
machine to be separate from the software in the remote connection this
increases chance of unintentional user error messing up data or even
malicious abuse.

Client packages:
x2goclient 4.1.2.2-7.f37
Package nx-libs 3.5.99.26-5.fc37
Package nxproxy 3.5.99.26-5.fc37

Debian 11 remote/Server packages:
x2goserver 4.1.0.3-5

Fedora 37 remote/Server packages:
x2goserver-4.1.0.3-19.fc37

Send a report that this bug log contains spam.

X2Go Developers <owner@bugs.x2go.org>. Last modified: Thu Nov 21 15:32:58 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.