Skip to content

Commit

Permalink
Fix bug#49773 in Tramp
Browse files Browse the repository at this point in the history
* lisp/net/tramp.el (tramp-handle-find-backup-file-name)
(tramp-handle-lock-file, tramp-handle-make-auto-save-file-name):
Check security hole only if action is in progress.  (Bug#49773)
  • Loading branch information
albinus committed Jul 30, 2021
1 parent 52a55e1 commit 245d3e9
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions lisp/net/tramp.el
Original file line number Diff line number Diff line change
Expand Up @@ -3665,6 +3665,7 @@ User is always nil."
#'find-backup-file-name (list filename)))
;; Protect against security hole.
(when (and (not tramp-allow-unsafe-temporary-files)
(not backup-inhibited)
(file-in-directory-p (car result) temporary-file-directory)
(zerop (or (tramp-compat-file-attribute-user-id
(file-attributes filename 'integer))
Expand Down Expand Up @@ -3885,6 +3886,7 @@ Return nil when there is no lockfile."
;; Protect against security hole.
(with-parsed-tramp-file-name file nil
(when (and (not tramp-allow-unsafe-temporary-files)
create-lockfiles
(file-in-directory-p lockname temporary-file-directory)
(zerop (or (tramp-compat-file-attribute-user-id
(file-attributes file 'integer))
Expand Down Expand Up @@ -5425,6 +5427,7 @@ this file, if that variable is non-nil."
(setq result (tramp-run-real-handler #'make-auto-save-file-name nil))
;; Protect against security hole.
(when (and (not tramp-allow-unsafe-temporary-files)
auto-save-default
(file-in-directory-p result temporary-file-directory)
(zerop (or (tramp-compat-file-attribute-user-id
(file-attributes filename 'integer))
Expand Down

0 comments on commit 245d3e9

Please sign in to comment.