emailauth, passwordauth: Avoid leaving cgisess_* files in the system temp directory.

Due to the use/abuse of CGI::Session to generate a token for the login
process, a new session database was created for each login, and left behind
afterwards. While each file is small, with many logings this could bloat
the size of /tmp significantly. Fixed by making CGI::Session write to
/dev/null, since there does not seem to be a way to entirely prevent the
writing.

This commit was sponsored by Henrik Riomar on Patreon.

diff --git a/IkiWiki/Plugin/emailauth.pm b/IkiWiki/Plugin/emailauth.pm
index 6674fe3d6b07b91ec9daf0d3276fa8936fc66378..9c595dc8643ede0a10a589bc38a968d2f635206b 100644 (file)
--- a/IkiWiki/Plugin/emailauth.pm
+++ b/IkiWiki/Plugin/emailauth.pm
@@ -148,7 +148,7 @@ sub gentoken ($$) {
        my $session=shift;
        eval q{use CGI::Session};
        error($@) if $@;
-       my $token = CGI::Session->new->id;
+       my $token = CGI::Session->new("driver:DB_File", undef, {FileName => "/dev/null"})->id;
        IkiWiki::userinfo_set($email, "emailauthexpire", time+(60*60*24));
        IkiWiki::userinfo_set($email, "emailauth", $token);
        IkiWiki::userinfo_set($email, "emailauthpostsignin", defined $session->param("postsignin") ? $session->param("postsignin") : "");

diff --git a/IkiWiki/Plugin/passwordauth.pm b/IkiWiki/Plugin/passwordauth.pm
index 33b8efbed41dcd93124a5442ba515bc7c94f410d..8d99cf2f69cc4e46f34e10f6b07959f3b2524fa0 100644 (file)
--- a/IkiWiki/Plugin/passwordauth.pm
+++ b/IkiWiki/Plugin/passwordauth.pm
@@ -113,7 +113,7 @@ sub gentoken ($$;$) {
 
        eval q{use CGI::Session};
        error($@) if $@;
-       my $token = CGI::Session->new->id;
+       my $token = CGI::Session->new("driver:DB_File", undef, {FileName => "/dev/null"})->id;
        if (! $reversable) {
                setpassword($user, $token, $tokenfield);
        }

diff --git a/debian/changelog b/debian/changelog
index 9c114bc3a78bd67e68191249618aa36c39e5dfd2..55a55bba01330641efb2e0fc42811c482cebd9cf 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -9,6 +9,10 @@ ikiwiki (3.20170623) UNRELEASED; urgency=medium
   * core: Don't decode the result of strftime if it is already tagged as
     UTF-8, as it might be since Perl >= 5.21.1. (Closes: #869240)
 
+  [ Joey Hess ]
+  * emailauth, passwordauth: Avoid leaving cgisess_* files in the
+    system temp directory.
+
  -- Joey Hess <id@joeyh.name>  Tue, 11 Jul 2017 15:48:39 -0400
 
 ikiwiki (3.20170622) unstable; urgency=medium