zerotier / DesktopUI

ZeroTier Desktop Tray Application and UI
https://zerotier.com
Mozilla Public License 2.0
176 stars 27 forks source link

authtoken copy path is calculated after privilege elevation #32

Closed glimberg closed 2 years ago

glimberg commented 2 years ago

When starting up the UI client on a non-privileged account, the tray app requests a privilege escalation in order to copy authoken.secret and zerotier.port to a location in the user's home directory. The method used to calculate the target directory is flawed in that it calculates the home directory after the privilege escalation occurs. This turns into an endless loop of privilege escalation prompts on Windows when attempting to launch the ui app from a non-Administrator account.

(PR incoming)