fix: correctly check if command is allowed when using shell

runner/parser.go

@@ -1,33 +1,24 @@
 package runner
 
 import (
-	"os/exec"
-
 	"github.com/filebrowser/filebrowser/v2/settings"
 )
 
 // ParseCommand parses the command taking in account if the current
 // instance uses a shell to run the commands or just calls the binary
 // directly.
-func ParseCommand(s *settings.Settings, raw string) ([]string, error) {
-	var command []string
-
-	if len(s.Shell) == 0 || s.Shell[0] == "" {
-		cmd, args, err := SplitCommandAndArgs(raw)
-		if err != nil {
-			return nil, err
-		}
-
-		_, err = exec.LookPath(cmd)
-		if err != nil {
-			return nil, err
-		}
-
-		command = append(command, cmd)
-		command = append(command, args...)
-	} else {
-		command = append(s.Shell, raw) //nolint:gocritic
+func ParseCommand(s *settings.Settings, raw string) (command []string, name string, err error) {
+	name, args, err := SplitCommandAndArgs(raw)
+	if err != nil {
+		return
 	}
 
-	return command, nil
+	if len(s.Shell) == 0 || s.Shell[0] == "" {
+		command = append(command, name)
+		command = append(command, args...)
+	} else {
+		command = append(s.Shell, raw)
+	}
+
+	return command, name, nil
 }

runner/runner.go

@@ -60,7 +60,7 @@ func (r *Runner) exec(raw, evt, path, dst string, user *users.User) error {
 		raw = strings.TrimSpace(strings.TrimSuffix(raw, "&"))
 	}
 
-	command, err := ParseCommand(r.Settings, raw)
+	command, _, err := ParseCommand(r.Settings, raw)
 	if err != nil {
 		return err
 	}