Changeset 1644 in MondoRescue for branches/2.2.5/mondo/src/common/libmondo-tools.c

Timestamp:

Sep 23, 2007, 2:41:29 AM (17 years ago)

Author:

Bruno Cornec

Message:

Apply patch from Andree Leidenfrost, modified a bit to use bkpinfo->tmpdir instead of /tmp
or MINDI_CACHE when appropriate. Fix security issues in mondo
Thanks al ot Andree for catching all those issues.
Will not compile needs more work as bkpinfo->tmpdir isn't available everywhere
Should become a global in 3.x when only containing pointers.

File:

• branches/2.2.5/mondo/src/common/libmondo-tools.c (modified) (3 diffs)

branches/2.2.5/mondo/src/common/libmondo-tools.c

@@ -999 +999 @@
     bkpinfo->scratchdir[0] = '\0';
     bkpinfo->make_filelist = TRUE;  // unless -J supplied to mondoarchive
-    sprintf(bkpinfo->tmpdir, "/tmp/tmpfs/mondo.tmp.%d", (int) (random() % 32768));  // for mondorestore
+    sprintf(bkpinfo->tmpdir, "%s/tmpfs/mondo.tmp.%d", "/tmp", (int) (random() % 32768));    // for mondorestore
     bkpinfo->optimal_set_size = 0;
     bkpinfo->backup_media_type = none;
@@ -1227 +1227 @@
         fatal_error("Please reinstall Mondo and Mindi.");
     }
-    if (run_program_and_log_output
-        ("mindi --makemountlist /tmp/mountlist.txt.test", 5)) {
-        log_to_screen
-            ("Mindi --makemountlist /tmp/mountlist.txt.test failed for some reason.");
+    sprintf(tmp, "mindi --makemountlist %s/mountlist.txt.test", bkpinfo->tmpdir);
+    if (run_program_and_log_output(tmp, 5)) {
+        sprintf(tmp, "mindi --makemountlist %s/mountlist.txt.test failed for some reason.", bkpinfo->tmpdir);
+        log_to_screen(tmp);
         log_to_screen
             ("Please run that command by hand and examine /var/log/mindi.log");
@@ -1494 +1494 @@
         return (1);
     }
-    strcpy(tempfile,
-           call_program_and_get_last_line_of_output
-           ("mktemp -q /tmp/mojo-jojo.blah.XXXXXX"));
+    sprintf(tempfile, "%s/mojo-jojo.blah", bkpinfo->tmpdir);
     if (does_file_exist(config_file)) {
         sprintf(command, "grep -vE '^%s .*$' %s > %s",