Bugs item #2796067, was opened at 2009-05-24 14:51
Message generated for change (Tracker Item Submitted) made by christian_boltz
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=937964&aid=2796067&group_id=191583
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Vacation
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Christian Boltz (christian_boltz)
Assigned to: Nobody/Anonymous (nobody)
Summary: Vacation (nearly) always uses /tmp/vacation.log as logfile
Initial Comment:
vacation.pl uses /tmp/vacation.log if the given $logfile does not yet exist.
The problem: There's a check
if ( ! -w $logfile ) {
$logfile = "/tmp/vacation.log";
}
The -w check will return false if $logfile does not exist. This means that nearly all installations will log to /tmp/vacation.log - at least I doubt that many people create $logfile manually.
The correct solution would be
- check if $logfile exists
- if yes, check if it is writeable (aka current code)
- if no, check if the _directory_ of $logfile is writeable, and create the logfile
If everything fails, write "can't open logfile $logfile" to syslog.
The automatic fallback to /tmp/vacation.log also introduces the risk of symlink attacks, therefore I'd prefer if this fallback was completely removed.
(Thanks to my AppArmor log for pointing out this bug ;-)
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=937964&aid=2796067&group_id=191583
|