Re: Security problem im temp directory.

[Dekel Tsur]

On Mon, Feb 26, 2001 at 06:09:30PM +0100, Stefan Eilers wrote:
> I know this solution. 
> But I think it should be the default way to protect tempfiles against
> other users in the system and not a nice option for paranoid people. Or
> do you think the ordinary lyx user want to be observable ?
> Therefore I thought of a solution which was included into the sources of
> lyx. A special startup script is ok (and the simplest way), but I think
> it should be included into the default package...

We only need to change one line in CreateTmpDir (in support/filetools.C)

-   if (tmpfl.empty() || lyx::mkdir(tmpfl, 0777)) {
+   if (tmpfl.empty() || lyx::mkdir(tmpfl, 0700)) {

(in fact, we should use S_IRUSR | S_IWUSR | S_IXUSR)

I don't see a reason for not making this change.