Re: [Scrollkeeper-devel] Porblem with temporary files creation

[Sander V. <San...@Su...>]

On Wed, 2 Oct 2002, Benjamin Thery wrote:

> -- Temporary files can be :
>     /tmp/scrollkeeper-tempfile.#,
>     where # is a number between 0 and 4.
> 
> -- In /tmp, all the five possible temporary files already existed and 
> were owned by another user.
>     On the same system we have about 4 or 5 GNOME 2 installations running.
>  

The sunray server here that has gnome2 (i'm not sure why we don't have it
on all of them) has normaly ~ 20 active gnome2 logins. yelp/scrollkeeper
don't really work on it as it stands 8-(

> -- scrollkeeper-get-content-list couldn't write its file but didn't 
> complain, because the other user owned all the temporary files.
> 
> -- Yelp parsed on of the file created by the other user which did not 
> contained all the entries.
> 
> -- As a result, I can access only the docs installed by the other user.
> 
> 
> I think the function get_next_free_temp_file_path() in cl/get-cl.c has a 
> problem.
> 
> -- Either, it must create the temporary file with write permission for 
> everyone,

This could be a huge & bad security problem.

> -- Or, the procedure to select a filename as to be changed (may be by 
> using a random file name or adding
> the username or UID to the temporary filename)
> 

This would be preferable - also yelp (and similar client programs) should
probably delete the fiel handed to them after they are done with it...

> 
> 
> -- 
> B e n j a m i n   T h e r y  - BULL/BI&S/GeODE/AIX & Linux CC
> 
>  mailto:Ben...@bu...
>    http://www.bull.com
> 

	Sander

	There are voices in the street,
	And the sound of running feet,
	And they whisper the word --
	Revolution!