diff --git a/ChangeLog b/ChangeLog index 3c4edf96e741c214641bc5f968cc892733c6efb4..fceeddaf57314b9200deb89da7862c341fceba50 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,8 +1,9 @@ 2010-04-02 Chris Allegretta <chrisa@asty.org> * files.c (do_writeout): Expand modification check to include both the original file's device ID and inode number as reasons to warn the - user that the file has been modified. Based on security article on nano - by Dan Rosenberg. + user that the file has been modified. Also abort on writing a backup + file when its owner doesn't match the edited file. Based on security + analysis on nano by Dan Rosenberg. 2010-03-21 Chris Allegretta <chrisa@asty.org> * nano.c (page_stdin et al): Don't attempt to reset/reopen the terminal diff --git a/src/files.c b/src/files.c index 8e63903a884a621d93c2deaeb65e83b48826a998..632c0f9ab4790e59bc91a76dd836ad6c3caff266 100644 --- a/src/files.c +++ b/src/files.c @@ -1519,6 +1519,7 @@ bool write_file(const char *name, FILE *f_open, bool tmp, append_type char *backupname; struct utimbuf filetime; int copy_status; + struct stat backupst; /* Save the original file's access and modification times. */ filetime.actime = openfile->current_stat->st_atime; @@ -1588,6 +1589,15 @@ bool write_file(const char *name, FILE *f_open, bool tmp, append_type sprintf(backupname, "%s~", realname); } + if (stat(backupname, &backupst) != -1 && + (backupst.st_uid != st.st_uid)) { + statusbar(_("Error writing backup file %s: Permission mismatch"), backupname, + strerror(errno)); + free(backupname); + goto cleanup_and_exit; + } + + /* Open the destination backup file. Before we write to it, we * set its permissions, so no unauthorized person can read it as * we write. */