Pass SED_SCRIPT to install.d scripts for templating action

Use mktemp to get the filename for storing the templating script
Using a fixed string could allow for abuse by anyone who has access to /tmp. One could place a symbolic link to any file to cause it to be overwritten when alternc.install is run.
2018-06-20 17:52:05 -04:00 · 2018-06-20 17:45:16 -04:00
1 changed files with 2 additions and 4 deletions
--- a/install/alternc.install
+++ b/install/alternc.install
@ -201,9 +201,7 @@ PUBLIC_IP_BEGIN=$(echo $PUBLIC_IP|cut -c 1)
 # Secret for PhpMyAdmin sessions
 PHPMYADMIN_BLOWFISH="$(generate_string 24)"

-# XXX: I assume this is secure if /tmp is sticky (+t)
-# we should have a better way to deal with templating, of course.
-SED_SCRIPT="/tmp/alternc.install.sedscript"
+SED_SCRIPT=$(mktemp)
 cat > $SED_SCRIPT <<EOF
 s\\%%hosting%%\\$HOSTING\\;
 s\\%%fqdn%%\\$FQDN\\;
@ -232,7 +230,7 @@ EOF

 # hook 
 test -d /usr/lib/alternc/install.d || mkdir -p /usr/lib/alternc/install.d
-run-parts --arg=templates /usr/lib/alternc/install.d 
+run-parts --arg=templates --arg="$SED_SCRIPT" /usr/lib/alternc/install.d


 ######################################################################
Author	SHA1	Message	Date
Kienan Stewart	7db33ba8f4	Pass SED_SCRIPT to install.d scripts for templating action	2018-06-20 17:52:05 -04:00
Kienan Stewart	25fb13a240	Use mktemp to get the filename for storing the templating script Using a fixed string could allow for abuse by anyone who has access to /tmp. One could place a symbolic link to any file to cause it to be overwritten when alternc.install is run.	2018-06-20 17:45:16 -04:00