j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-11 04:36:48 +00:00
Code Issues Projects Releases Wiki Activity

fix: write the admin password file without following symlinks

Browse source 
In Docker, migrate runs as root while data/ belongs to www-data, so a
planted data/admin_password symlink would make root overwrite its target.
Remove any existing path first and create the file with
O_CREAT|O_EXCL|O_NOFOLLOW (mode set via fchmod). install.sh's /tmp
fallback log is now created with mktemp instead of a fixed name.
This commit is contained in:
catborise 2026-10-02 23:17:32 +03:00
parent 02dd838a56
commit 40822e7184
3 changed files with 21 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
install.sh
View file

@ -83,8 +83,7 @@ chmod 744 "$INSTALLER"
LOG_FILE="/var/log/webvirtcloud-install.log"
mkdir -p "$(dirname "$LOG_FILE")" 2>/dev/null || true
if ! touch "$LOG_FILE" 2>/dev/null; then
LOG_FILE="/tmp/webvirtcloud-install.log"
touch "$LOG_FILE"
LOG_FILE="$(mktemp /tmp/webvirtcloud-install.XXXXXX)"
fi
chmod 600 "$LOG_FILE" 2>/dev/null || true