thodg/libgit2/src

Diff

  • Show log

    Commit

  • Hash : 0967459e
    Author : Patrick Steinhardt
    Date : 2018-01-25T13:11:34 

    sysdir: do not use environment in setuid case

In order to derive the location of some Git directories, we currently
use the environment variables $HOME and $XDG_CONFIG_HOME. This might
prove to be problematic whenever the binary is run with setuid, that is
when the effective user does not equal the real user. In case the
environment variables do not get sanitized by the caller, we thus might
end up using the real user's configuration when doing stuff as the
effective user.

The fix is to use the passwd entry's directory instead of $HOME in this
situation. As this might break scenarios where the user explicitly sets
$HOME to another path, this fix is only applied in case the effective
user does not equal the real user.

kmx.io     mail     discord kmxgit v0.4.0