Merge commit from fork

CVE-2026-33145: Default AllowAlternateShell to 'no'

sesman/libsesman/sesman_config.c

@@ -320,7 +320,7 @@ config_read_security(int file, struct config_security *sc,
     sc->xauth_in_sysdir = 0;
     sc->restrict_outbound_clipboard = 0;
     sc->restrict_inbound_clipboard = 0;
-    sc->allow_alternate_shell = 1;
+    sc->allow_alternate_shell = 0;
     sc->pass_shell_as_env = g_strdup("");
     sc->xorg_no_new_privileges = 1;
     sc->ts_users = g_strdup("");

sesman/sesman.ini.in

@@ -43,8 +43,8 @@ RestrictOutboundClipboard=none
 ;   false: an alias of none
 ;   yes: an alias of all
 RestrictInboundClipboard=none
-; Set to 'no' to prevent users from logging in with alternate shells
-#AllowAlternateShell=true
+; Set to 'yes' to allow users to log in with alternate shells
+#AllowAlternateShell=no
 ; Normally, alternate shells (if permitted) are executed directly, as
 ; specified.
 ; If this is set, alternate shells are not actioned directly, but