hharte / mm_manager

Manager for the Nortel Millennium series of payphones.
Other
54 stars 10 forks source link

unsafe work with the file. #10

Closed ihsinme closed 2 years ago

ihsinme commented 2 years ago

Good afternoon. you are working with a writeable file with a predictable name and without setting restrictive access rights. this can lead to security, disclosure and accessibility issues. I propose to consider the issue of limiting rights and forming a name, for example, through mkstemp

https://github.com/hharte/mm_manager/blob/1c9c7934c97881be57c5ecd12ebf33136f4cf199/mm_manager.c#L355

hharte commented 2 years ago

Thanks, I removed support for writing to a .csv file and instead use a database to store CDRs and other information. See commit: 09e91107956515913e39bf5d22c084c65b5fd136