cookie parameter protection

[xavierba]

Hi,
sympa.conf is set to mode 640 in order to protect the cookie from being world readable.
However, the sympa.conf.bin file is mode 644, whereas it should be 640 too.

Also, cookie should be marked as obfuscated in ConfDef.pm, in order to prevent it from being displayed in the web interface.

Regards,
Xavier

[ikedas]

We worked on the same issue. :-) Choose better one.

[xavierba]

@racke didn't like my patch very much, and as I wrote I didn't even test it, I just wanted to update the issue. I'm not fond of the chown/chmod, it seems to me there is a race condition between file creation, chown and chmod steps, using umask seems slightly better, although not perfect. It would be even better to have the .bin files created with good owner/group and mode from the very start. Also, your PR is better, it handles the db_password parameter too.

[ikedas]

ok @racke, could you please review these two when you come back (or submit the third by your own :))?

[ikedas]

PR has been merged.