Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-11-03 19:08:50 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'ghsa-wxf6-3mh5-rcj6/advisory-fix-1'

Browse source
This commit is contained in:
djmaze 2026-11-03 15:24:12 +01:00
commit 8d02773df6
1 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
View file

@ -72,11 +72,19 @@ trait Pgp
\clearstatcache();
// First try a symbolic link
$tmpdir = \sys_get_temp_dir() . '/snappymail';
// if (\RainLoop\Utils::inOpenBasedir($tmpdir) &&
// if (\RainLoop\Utils::inOpenBasedir($tmpdir)) {
\is_dir($tmpdir) || \mkdir($tmpdir, 0700);
if (\is_dir($tmpdir) && \is_writable($tmpdir)) {
$link = $tmpdir . '/' . \md5($homedir);
if (\is_link($link) || \symlink($homedir, $link)) {
// \sprintf("%06u ", \substr(\decoct(\lstat($tmpdir)['mode']),-3))
if (\is_dir($tmpdir) && \is_writable($tmpdir) && \substr(\sprintf('%o', \fileperms($tmpdir)), -4) === "0700") {
$link = $tmpdir . '/' . \md5($homedir . APP_SALT);
// Make sure the symbolic link points to $homedir
if (\is_link($link) && \readlink($link) !== $homedir) {
if (!\unlink($link)) {
$this->logWrite("unlink('{$link}') failed", \LOG_WARNING, 'GnuPG');
}
}
if ((\is_link($link) && \readlink($link) === $homedir)
|| \symlink($homedir, $link)) {
$homedir = $link;
} else {
$this->logWrite("symlink('{$homedir}', '{$link}') failed", \LOG_WARNING, 'GnuPG');
@ -84,7 +92,8 @@ trait Pgp
}
// Else try ~/.gnupg/ + hash(email address)
if (80 < \strlen($homedir)) {
$tmpdir = ($_SERVER['HOME'] ?: \exec('echo ~') ?: \dirname(\getcwd())) . '/.gnupg/';
$home = $_SERVER['HOME'] ?: \exec('echo ~');
$tmpdir = ('~' !== $home ? $home : \dirname(\getcwd())) . '/.gnupg/';
if ($oAccount instanceof \RainLoop\Model\AdditionalAccount) {
$tmpdir .= \sha1($oAccount->ParentEmail());
} else {