Faidon Liambotis has submitted this change and it was merged.
Change subject: phabricator/phab_epipe: use tempfile to write /tmp files
......................................................................
phabricator/phab_epipe: use tempfile to write /tmp files
Makes it a little more secure by avoiding a couple of minor tmpfile
overwrite vulnerabilities.
Change-Id: I6dad9afce8ad7510126da924a8122ba3b4692cb6
---
M modules/phabricator/files/phab_epipe.py
1 file changed, 14 insertions(+), 20 deletions(-)
Approvals:
Rush: Looks good to me, but someone else must approve
Faidon Liambotis: Looks good to me, approved
jenkins-bot: Verified
diff --git a/modules/phabricator/files/phab_epipe.py
b/modules/phabricator/files/phab_epipe.py
index 13ca26b..950b907 100644
--- a/modules/phabricator/files/phab_epipe.py
+++ b/modules/phabricator/files/phab_epipe.py
@@ -16,7 +16,7 @@
security = users
# if 'true' will reject all email to phab
maint = false
- # saves every message overwriting /tmp/rawmail
+ # saves every message to /tmp/phabmail_*
save = false
# saves particular messages from a comma
# separated list of users
@@ -48,6 +48,7 @@
import syslog
from email.parser import Parser
from email.utils import parseaddr
+from tempfile import NamedTemporaryFile
import ConfigParser
from phabricator import Phabricator
@@ -284,23 +285,16 @@
if defaults['maint'].lower() == 'true':
raise EmailStatusError('Email interaction is currently disabled.')
- if '-s' in sys.argv:
- save = '/tmp/maildump'
- elif 'save' in defaults:
- save = defaults['save']
- else:
- save = False
-
if 'debug' in defaults:
defaults['debug'] = defaults['debug'].lower().split(',')
# Reading in the message
stdin = sys.stdin.read()
- if save:
- log('saving raw email to %s' % save)
- with open(save, 'w') as r:
- r.write(stdin)
+ if '-s' in sys.argv or defaults.get('save', False):
+ with NamedTemporaryFile(prefix='phabmail_', delete=False) as temp:
+ log('saving raw email to %s' % temp.name)
+ temp.write(stdin)
# ['Received', 'DKIM-Signature', 'X-Google-DKIM-Signature',
# 'X-Gm-Message-State', 'X-Received', 'Received',
@@ -316,14 +310,14 @@
else:
cc_addresses = []
- # Some email clients do crazy things and it is very
- # difficult to debug without the raw message. In these (rare)
- # cases we can add the sender to debug to log
- if 'debug' in defaults:
- src = src_addy.lower().strip()
- if src in defaults['debug']:
- with open('/tmp/%s' % (src_addy + '.txt'), 'w') as r:
- r.write(stdin)
+ # Some email clients do crazy things and it is very difficult to debug
+ # without the raw message. In these (rare) cases we can add the sender to
+ # debug to log
+ src = src_addy.lower().strip()
+ if src in defaults.get('debug', []):
+ prefix = "phabmail_%s_" % src
+ with NamedTemporaryFile(prefix=prefix, delete=False) as temp:
+ temp.write(stdin)
# does this email have a direct to task addresss
dtask = extract_direct_task(dest_addresses + cc_addresses)
--
To view, visit https://gerrit.wikimedia.org/r/284069
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I6dad9afce8ad7510126da924a8122ba3b4692cb6
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Faidon Liambotis <fai...@wikimedia.org>
Gerrit-Reviewer: Faidon Liambotis <fai...@wikimedia.org>
Gerrit-Reviewer: Rush <r...@wikimedia.org>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
