revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-19 13:22:42 +01:00
Code Issues Releases Wiki Activity

Don't leave temporary files around when trying to use credentials with destroyed secrets

Browse source 
Summary: Ref T4284. This fixes at least one problem which can cause the observed behavior.

Test Plan:
  - Before applying patch, used `PHABRICATOR_CREDENTIAL=PHID-CDTL-... bin/ssh-connect` + debugging prints to verify the keyfile was written and cleaned up normally.
  - Destroyed the credental, verified the temporary file was not cleand up correctly.
  - Applied patch, verified temporary file was not written and command exited with sensible error.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4284

Differential Revision: https://secure.phabricator.com/D10328
This commit is contained in:
epriestley 2014-08-21 11:26:02 -07:00
parent 7d31ea7c55
commit 241cfc2e83
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/applications/passphrase/keys/PassphraseSSHKey.php
View file

@ -17,16 +17,21 @@ final class PassphraseSSHKey extends PassphraseAbstractKey {
$file_type = PassphraseCredentialTypeSSHPrivateKeyFile::CREDENTIAL_TYPE; $file_type = PassphraseCredentialTypeSSHPrivateKeyFile::CREDENTIAL_TYPE;
if ($credential->getCredentialType() != $file_type) { if ($credential->getCredentialType() != $file_type) {
// If the credential does not store a file, write the key txt out to a // If the credential does not store a file, write the key text out to a
// temporary file so we can pass it to `ssh`. // temporary file so we can pass it to `ssh`.
if (!$this->keyFile) { if (!$this->keyFile) {
$secret = $credential->getSecret();
if (!$secret) {
throw new Exception(
pht(
'Attempting to use a credential ("%s") but the credential '.
'secret has been destroyed!',
$credential->getMonogram()));
}
$temporary_file = new TempFile('passphrase-ssh-key'); $temporary_file = new TempFile('passphrase-ssh-key');
Filesystem::changePermissions($temporary_file, 0600); Filesystem::changePermissions($temporary_file, 0600);
Filesystem::writeFile($temporary_file, $secret->openEnvelope());
Filesystem::writeFile(
$temporary_file,
$credential->getSecret()->openEnvelope());
$this->keyFile = $temporary_file; $this->keyFile = $temporary_file;
} }