[Python-bugs-list] fileinput in-place editing mangles permissions (PR#111)

[anton@lifix.fi]

Full_Name: Anton Gyllenberg
Version: 1.5.2
OS: Debian GNU/Linux 2.2 (potato)
Submission from: proxy2.clinet.fi (194.100.0.205)


When using the fileinput modules in-place editing facility, the original
file is moved to a temporary filename, and the output is directed to a
new file with the same name as the original. However, the permissions on
the new file are not set. This can cause serious security problems with
secret files becoming readable after editing. A second not so serious
problem is when no backup suffix is specified. Then the default suffix of
`.bak' is assumed. If you for some reason already have a `filename.bak',
that file will mysteriously disappear. This can be fixed using real
tempfiles as in the tempfile module.

I am not a experienced python programmer, and I may very well have
overlooked something. However, I believe that something like this patch
will fix the more serious permission problem:


--- /usr/lib/python1.5/fileinput.py     Fri Jul 16 20:04:25 1999
+++ fileinput.py        Sun Oct 17 20:48:22 1999
@@ -74,6 +74,7 @@
 """
 
 import sys, os
+from stat import ST_MODE
 
 _state = None
 
@@ -207,6 +208,8 @@
                     os.rename(self._filename, self._backupfilename)
                     self._file = open(self._backupfilename, "r")
                     self._output = open(self._filename, "w")
+                    os.chmod(self._filename,
+                        os.stat(self._backupfilename)[ST_MODE])
                     self._savestdout = sys.stdout
                     sys.stdout = self._output
                 else:

--
Anton Gyllenberg <anton@lifix.fi>                        +358-50-3412792

I hope this is unnecessary, but...:
I confirm that, to the best of my knowledge and belief, this
contribution is free of any claims of third parties under
copyright, patent or other rights or interests ("claims").  To
the extent that I have any such claims, I hereby grant to CNRI a
nonexclusive, irrevocable, royalty-free, worldwide license to
reproduce, distribute, perform and/or display publicly, prepare
derivative versions, and otherwise use this contribution as part
of the Python software and its related documentation, or any
derivative versions thereof, at no cost to CNRI or its licensed
users, and to authorize others to do so.

I acknowledge that CNRI may, at its sole discretion, decide
whether or not to incorporate this contribution in the Python
software and its related documentation.  I further grant CNRI
permission to use my name and other identifying information
provided to CNRI by me for use in connection with the Python
software and its related documentation.