[PATCH v2 0/2] Correctly handle transient files in shared repositories

[Johannes Schindelin <johannes.schindelin@gmx.de>]

Transient files, e.g. commit messages, are writable only by the owner,
even in shared repositories, to avoid interference between competing
users working on the same files.

These files are typically not deleted after use. As a consequence, we
have to delete such files before writing when they are owned by someone
else than the current user.

Reported-by: Yaroslav Halchenko <yoh@onerussian.com>


Johannes Schindelin (2):
  commit: allow editing the commit message even in shared repos
  Handle more file writes correctly in shared repos

 builtin/commit.c      |  2 +-
 builtin/fast-export.c |  2 +-
 builtin/fetch.c       |  2 +-
 git-compat-util.h     |  1 +
 wrapper.c             | 13 +++++++++++++
 5 files changed, 17 insertions(+), 3 deletions(-)

Interdiff vs v1:

 diff --git a/builtin/commit.c b/builtin/commit.c
 index 3bfd457..89bf6ad 100644
 --- a/builtin/commit.c
 +++ b/builtin/commit.c
 @@ -761,7 +761,7 @@ static int prepare_to_commit(const char *index_file, const char *prefix,
  		hook_arg2 = "";
  	}
  
 -	s->fp = fopen(git_path(commit_editmsg), "w");
 +	s->fp = fopen_for_writing(git_path(commit_editmsg));
  	if (s->fp == NULL)
  		die_errno(_("could not open '%s'"), git_path(commit_editmsg));
  
 @@ -905,7 +905,6 @@ static int prepare_to_commit(const char *index_file, const char *prefix,
  	strbuf_release(&committer_ident);
  
  	fclose(s->fp);
 -	adjust_shared_perm(git_path(commit_editmsg));
  
  	/*
  	 * Reject an attempt to record a non-merge empty commit without
 diff --git a/builtin/fast-export.c b/builtin/fast-export.c
 index d9ac5d8..2471297 100644
 --- a/builtin/fast-export.c
 +++ b/builtin/fast-export.c
 @@ -880,7 +880,7 @@ static void export_marks(char *file)
  	FILE *f;
  	int e = 0;
  
 -	f = fopen(file, "w");
 +	f = fopen_for_writing(file);
  	if (!f)
  		die_errno("Unable to open marks file %s for writing.", file);
  
 diff --git a/builtin/fetch.c b/builtin/fetch.c
 index 586840d..33f04c1 100644
 --- a/builtin/fetch.c
 +++ b/builtin/fetch.c
 @@ -840,7 +840,7 @@ static void check_not_current_branch(struct ref *ref_map)
  static int truncate_fetch_head(void)
  {
  	const char *filename = git_path_fetch_head();
 -	FILE *fp = fopen(filename, "w");
 +	FILE *fp = fopen_for_writing(filename);
  
  	if (!fp)
  		return error(_("cannot open %s: %s\n"), filename, strerror(errno));
 diff --git a/git-compat-util.h b/git-compat-util.h
 index 2da0a75..e8f2867 100644
 --- a/git-compat-util.h
 +++ b/git-compat-util.h
 @@ -733,6 +733,7 @@ extern int xmkstemp_mode(char *template, int mode);
  extern int odb_mkstemp(char *template, size_t limit, const char *pattern);
  extern int odb_pack_keep(char *name, size_t namesz, const unsigned char *sha1);
  extern char *xgetcwd(void);
 +extern FILE *fopen_for_writing(const char *path);
  
  #define REALLOC_ARRAY(x, alloc) (x) = xrealloc((x), (alloc) * sizeof(*(x)))
  
 diff --git a/wrapper.c b/wrapper.c
 index b43d437..29a45d2 100644
 --- a/wrapper.c
 +++ b/wrapper.c
 @@ -391,6 +391,19 @@ FILE *xfdopen(int fd, const char *mode)
  	return stream;
  }
  
 +FILE *fopen_for_writing(const char *path)
 +{
 +	FILE *ret = fopen(path, "w");
 +
 +	if (!ret && errno == EPERM) {
 +		if (!unlink(path))
 +			ret = fopen(path, "w");
 +		else
 +			errno = EPERM;
 +	}
 +	return ret;
 +}
 +
  int xmkstemp(char *template)
  {
  	int fd;

-- 
2.6.3.windows.1.300.g1c25e49