|
From: SourceForge.net <no...@so...> - 2009-05-24 12:51:30
|
Bugs item #2796067, was opened at 2009-05-24 14:51 Message generated for change (Tracker Item Submitted) made by christian_boltz You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=937964&aid=2796067&group_id=191583 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Vacation Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Christian Boltz (christian_boltz) Assigned to: Nobody/Anonymous (nobody) Summary: Vacation (nearly) always uses /tmp/vacation.log as logfile Initial Comment: vacation.pl uses /tmp/vacation.log if the given $logfile does not yet exist. The problem: There's a check if ( ! -w $logfile ) { $logfile = "/tmp/vacation.log"; } The -w check will return false if $logfile does not exist. This means that nearly all installations will log to /tmp/vacation.log - at least I doubt that many people create $logfile manually. The correct solution would be - check if $logfile exists - if yes, check if it is writeable (aka current code) - if no, check if the _directory_ of $logfile is writeable, and create the logfile If everything fails, write "can't open logfile $logfile" to syslog. The automatic fallback to /tmp/vacation.log also introduces the risk of symlink attacks, therefore I'd prefer if this fallback was completely removed. (Thanks to my AppArmor log for pointing out this bug ;-) ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=937964&aid=2796067&group_id=191583 |
