mirror/archivemail
1
0
Fork 0
mirror of https://git.code.sf.net/p/archivemail/code synced 2025-03-12 07:42:50 +00:00
Code Issues Releases Wiki Activity

If we are running as root we setuid() to the user who owns the mailbox. But I

Browse source 
forgot to make sure we create our temporary container directory as that user
too.
This commit is contained in:
Paul Rodger 2002-09-16 11:35:03 +00:00
parent 3939c48518
commit baeb03abd4
1 changed files with 15 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
archivemail.py
View file

@ -943,17 +943,6 @@ def archive(mailbox_name):
os.path.basename(final_archive_name))
vprint("archiving '%s' to '%s' ..." % (mailbox_name, final_archive_name))
# create a temporary directory for us to work in securely
old_temp_dir = tempfile.tempdir
tempfile.tempdir = None
new_temp_dir = tempfile.mktemp('archivemail')
assert(new_temp_dir)
os.mkdir(new_temp_dir)
_stale.temp_dir = new_temp_dir
tempfile.tempdir = new_temp_dir
vprint("set tempfile directory to '%s'" % new_temp_dir)
# check to see if we are running as root -- if so, change our effective
# userid and groupid to that of the original mailbox
if (os.getuid() == 0) and os.path.exists(mailbox_name):
@ -964,6 +953,16 @@ def archive(mailbox_name):
vprint("changing effective user id to: %d" % mailbox_user)
os.seteuid(mailbox_user)
# create a temporary directory for us to work in securely
old_temp_dir = tempfile.tempdir
tempfile.tempdir = None
new_temp_dir = tempfile.mktemp('archivemail')
assert(new_temp_dir)
os.mkdir(new_temp_dir)
_stale.temp_dir = new_temp_dir
tempfile.tempdir = new_temp_dir
vprint("set tempfile directory to '%s'" % new_temp_dir)
if os.path.islink(mailbox_name):
unexpected_error("'%s' is a symbolic link -- I feel nervous!" %
mailbox_name)
@ -982,14 +981,16 @@ def archive(mailbox_name):
else:
user_error("'%s': no such file or directory" % mailbox_name)
# remove our special temp directory - hopefully empty
os.rmdir(new_temp_dir)
_stale.temp_dir = None
tempfile.tempdir = old_temp_dir
# if we are running as root, revert the seteuid()/setegid() above
if (os.getuid() == 0):
vprint("changing effective groupid and userid back to root")
os.setegid(0)
os.seteuid(0)
os.rmdir(new_temp_dir)
_stale.temp_dir = None
tempfile.tempdir = old_temp_dir
def _archive_mbox(mailbox_name, final_archive_name):