temp directory contents not cleaned up on logout

[wwiv]

Build: r1099
Operating System: Linux

What Happened: drop files in temp directory do not get cleaned up on logout. They get updated when a door is accessed, which means it's possible for the wrong user's data to exist in a node's temp dir

What was expected: temp files are removed when a user's session ends.

Original comment by: granitepenguin

[wwiv]

Thinking about this more do we really want to do this? It's been handy throughout the years to have the files live on while testing out doors, etc.

WTDY?

Original comment by: wwiv

[wwiv]

it's a security issue. Since the files are not cleaned up, a different user can get access to information left behind by the previous user. It's generally just drop files, but what if there are other files in the temp directory that have something more sensitive?

Original comment by: granitepenguin

[wwiv]

ok, I looked a bit closer, and everything except for the drop files are deleted on exit (by design). I'm not saying the design is right but it purposely leaves the drop files.

Here's the code:

while (bFound) {
char szFileName[MAX_PATH];
strcpy(szFileName, fnd.GetFileName());

//
// We don't want to delete ".", "..", or any of the door drop files
// (you can't delete . or .. anyway!  but it's a waste of time to try...
//
if (!IsEqualsIgnoreCase(szFileName, "chain.txt") &&
    !IsEqualsIgnoreCase(szFileName, "door.sys") &&
    !IsEqualsIgnoreCase(szFileName, "door32.sys") &&
    !IsEqualsIgnoreCase(szFileName, "dorinfo1.def") &&
    !IsEqualsIgnoreCase(szFileName, "callinfo.bbs") &&
    !IsEqualsIgnoreCase(szFileName, "pcboard.sys") &&
    !IsEqualsIgnoreCase(szFileName, ".") &&
    !IsEqualsIgnoreCase(szFileName, "..")) {
  if (bPrintStatus) {
    std::clog << "Deleting TEMP file: " << pszDirectoryName << szFileName << std::endl;
  }
  File::Remove(pszDirectoryName, szFileName);
}
bFound = fnd.next();

}

Original comment by: wwiv

[wwiv]

This was fixed in r1386

Original comment by: wwiv

[wwiv]

• status: open --> closed
• assigned_to: Rushfan

Original comment by: wwiv