Users can start services on other users' machines #984

user_id = request.args.get("user")
password = request.args.get("password")
service = request.args.get("service")

if user_id and not password and not is_admin():
    abort(403)

 user = get_current_user() if not user_id else Users.query.filter_by(id=int(user_id)).first_or_404()

if start_on_demand_service(user, service) is False:
    return {"success": False, "active": True, "error": f"Failed to start service {service}"}

on_demand_services = { "terminal", "code", "desktop"}

def start_on_demand_service(user, service_name):
    if service_name not in on_demand_services:
        return None
    try:
        exec_run(
            f"/run/current-system/sw/bin/timeout -k 10 30 /run/current-system/sw/bin/dojo-{service_name}",
            workspace_user="hacker",
            user_id=user.id,
            assert_success=True,
            log=True,
        )

if service == "desktop":
    interact_password = container_password(container, "desktop", "interact")
    view_password = container_password(container, "desktop", "view")

    if user_id and password:
        if not hmac.compare_digest(password, interact_password) and not hmac.compare_digest(password, view_password):
            abort(403)
        password = password[:8]
    else:
        password = interact_password[:8]