I think setup_file should also have strict permissions like 600, since files in /tmp are world readable by default. Even though we delete a file later, there is a time interval when this file can be read.

@vashirov - changes made!

I still can read this file using while loop under regular user:

while : ; do ls -la /tmp/*inf 2> /dev/null; cat /tmp/*inf 2> /dev/null; done

If I run this loop on a terminal, and create an instance in webui, I can see contents of the file for some time.

We should create an empty file with strict permissions fist and only then write data there.

Also, it seems that the password is literally set to 'False' (line 855:

        setup_inf = setup_inf.replace('ROOTPW', 'False');

After I create an instance through webui, my password doesn't work, but 'False' works.

@vashirov - fixed!

Perhaps we can move chmod before writing any data here as well. The rest LGTM, ack.

But this just the example template. Nothing is sensitive in it, but I'll change it just in case.

The problem with this is that it may affect container builds. So the dockerfile needs an update.

As well, people may not want to write to a "specific" location, that's why I put it to stdotu, to let people choose what they wanted to do with it, pipe, edit, etc.

So I'm not really for this change, but I can't stop it either.

The problem with this is that it may affect container builds. So the dockerfile needs an update.

Doing that now...

As well, people may not want to write to a "specific" location, that's why I put it to stdotu, to let people choose what they wanted to do with it, pipe, edit, etc.

That still works, the output file is only an option

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/2864

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.