Security issue with /tmp/tickeys.log and /tmp/tickeys_terminal_window_id

[hartwork]

Hi there!

Using predictable paths in a word-writable directory like /tmp is a security risk, as other users can run soft- and hardlinks attacks on us, for instance. Affected paths are:

• /tmp/tickeys.log
• /tmp/tickeys_terminal_window_id

As your use is not of classic tempfile nature, for a fix maybe use ${HOME}/.tickeys/..... instead.

For /tmp/ktexturecompress......... please use the tempfile module for mitigation, instead.

Thanks and best, Sebastian

[BillBillBillBill]

Hi, thank you for your advice, you are wrong, I will fix it in the next version:)

[hartwork]

Any news?

[BillBillBillBill]

alreay fixed:)

[hartwork]

It seems that the related commits are not contained in any release, yet. Please make a new release containing these fixes. Many thanks!

For the record, I found mentioned fixes here:

• /tmp/tickeys.log to ~/.tickeys/tickeys.log https://github.com/BillBillBillBill/Tickeys-linux/commit/807eb9fefd0013ded02675310eee0f7e53b71f05#diff-d79de8b43cb95c46454c797e0e693bdfR15
• /tmp/tickeys_terminal_window_id to ~/.tickeys/tickeys_terminal_window_id https://github.com/BillBillBillBill/Tickeys-linux/commit/b31843c2b4500df2e89390850aeb0bcf6734879d#diff-0a3658c777763b6f4489189174780936R9