Beta Branch fix dmotd and check-for-updates version cache in /tmp in 140.00beta01

fix dmotd and check-for-updates version cache in /tmp in 140.00beta01

The dmotd login banner and the check-for-updates.sh cron cached the latest
nginx and PHP versions in /tmp/nginx_version_cache and /tmp/php_version_cache.
Any local user could create these files in world-writable /tmp, and a fresh
cache was read back by root and passed unquoted to curl, so its content could
add curl options such as -H @/etc/shadow or -K. The nginx value also reached
the login banner and Pushover alert text.

Changes:
- move both caches to root-only /var/cache/centminmod/version-check (mode 0700); non-root dmotd runs use no cache
- accept cached and fetched versions only when they are x.y.z, anything else is treated as no data
- quote the php.net tarball URL and skip that check when there is no valid PHP version
- inc/php_upgrade.inc and inc/nginx_upgrade.inc remove the caches at the new path after menu 5 and menu 4 upgrades

---

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01