Merge pull request #288 from mscherer/fix_cve

Fix CVE-2016-5026
This commit is contained in:
Micah Lee 2016-06-10 17:18:36 -07:00 committed by GitHub
commit 7f438052c6

View File

@ -102,16 +102,7 @@ class HS(object):
self.hidserv_dir = self.hidserv_dir.replace('\\', '/') self.hidserv_dir = self.hidserv_dir.replace('\\', '/')
else: else:
path = '/tmp/onionshare' self.hidserv_dir = tempfile.mkdtemp(suffix='onionshare',dir='/tmp')
try:
if not os.path.exists(path):
os.makedirs(path, 0o700)
except:
raise HSDirError(strings._("error_hs_dir_cannot_create").format(path))
if not os.access(path, os.W_OK):
raise HSDirError(strings._("error_hs_dir_not_writable").format(path))
self.hidserv_dir = tempfile.mkdtemp(dir=path)
self.cleanup_filenames.append(self.hidserv_dir) self.cleanup_filenames.append(self.hidserv_dir)
@ -233,17 +224,17 @@ class HS(object):
'80 127.0.0.1:33302' '80 127.0.0.1:33302'
], ],
'HiddenServiceDir': [ 'HiddenServiceDir': [
'/tmp/onionshare/tmplTfZZu', '/tmp/onionsharelTfZZu',
'/tmp/onionshare/tmpchDai3' '/tmp/onionsharechDai3'
] ]
} }
Output will look like this: Output will look like this:
[ [
('HiddenServiceDir', '/tmp/onionshare/tmplTfZZu'), ('HiddenServiceDir', '/tmp/onionsharelTfZZu'),
('HiddenServicePort', '80 127.0.0.1:47906'), ('HiddenServicePort', '80 127.0.0.1:47906'),
('HiddenServiceDir', '/tmp/onionshare/tmpchDai3'), ('HiddenServiceDir', '/tmp/onionsharechDai3'),
('HiddenServicePort', '80 127.0.0.1:33302') ('HiddenServicePort', '80 127.0.0.1:33302')
] ]
""" """