From d9ab776119fa929a3e5751eb7844cf1c6db11f23 Mon Sep 17 00:00:00 2001
From: djmaze <>
Date: Wed, 28 Oct 2026 01:01:15 +0100
Subject: [PATCH] Resolve ghsa-wxf6-3mh5-rcj6

---
 .../app/libraries/RainLoop/Actions/Pgp.php    | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
index a87b6d1da..3ebc06099 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
@@ -72,11 +72,19 @@ trait Pgp
 			\clearstatcache();
 			// First try a symbolic link
 			$tmpdir = \sys_get_temp_dir() . '/snappymail';
-//			if (\RainLoop\Utils::inOpenBasedir($tmpdir) &&
+//			if (\RainLoop\Utils::inOpenBasedir($tmpdir)) {
 			\is_dir($tmpdir) || \mkdir($tmpdir, 0700);
-			if (\is_dir($tmpdir) && \is_writable($tmpdir)) {
-				$link = $tmpdir . '/' . \md5($homedir);
-				if (\is_link($link) || \symlink($homedir, $link)) {
+//			\sprintf("%06u ", \substr(\decoct(\lstat($tmpdir)['mode']),-3))
+			if (\is_dir($tmpdir) && \is_writable($tmpdir) && \substr(\sprintf('%o', \fileperms($tmpdir)), -4) === "0700") {
+				$link = $tmpdir . '/' . \md5($homedir . APP_SALT);
+				// Make sure the symbolic link points to $homedir
+				if (\is_link($link) && \readlink($link) !== $homedir) {
+					if (!\unlink($link)) {
+						$this->logWrite("unlink('{$link}') failed", \LOG_WARNING, 'GnuPG');
+					}
+				}
+				if ((\is_link($link) && \readlink($link) === $homedir)
+				 || \symlink($homedir, $link)) {
 					$homedir = $link;
 				} else {
 					$this->logWrite("symlink('{$homedir}', '{$link}') failed", \LOG_WARNING, 'GnuPG');
@@ -84,7 +92,8 @@ trait Pgp
 			}
 			// Else try ~/.gnupg/ + hash(email address)
 			if (80 < \strlen($homedir)) {
-				$tmpdir = ($_SERVER['HOME'] ?: \exec('echo ~') ?: \dirname(\getcwd())) . '/.gnupg/';
+				$home = $_SERVER['HOME'] ?: \exec('echo ~');
+				$tmpdir = ('~' !== $home ? $home : \dirname(\getcwd())) . '/.gnupg/';
 				if ($oAccount instanceof \RainLoop\Model\AdditionalAccount) {
 					$tmpdir .= \sha1($oAccount->ParentEmail());
 				} else {