D7146: Fix information leak via /tmp

[Thomas Posch]

thomasp added inline comments.

INLINE COMMENTS

> notification.cpp:37
>  {
> -    mImagesDir = QDir::temp().absoluteFilePath(QStringLiteral("kdeconnect"));
> +    // Use CacheLocation instead of TempLocation because TempLocation may be accessible system-wide
> +    mImagesDir = QDir(QStandardPaths::writableLocation(QStandardPaths::CacheLocation));

Are the icons reused over restarts? In that case a cache is what you want.
If they are only short lived, TempLocation is a better fit as /tmp is usually a tmpfs(5).
Writing the files to disk just to delete them 5 seconds later does nothing but wear the disk.
To address the privacy concerns, set appropriate permissions on the directory (i.e. only owner should have access)

> notification.cpp:119
> +            destinationUrl.setScheme(QStringLiteral("file"));
>              FileTransferJob* job = np.createPayloadTransferJob(destinationUrl);
>              job->start();

Where is this file deleted?

REPOSITORY
  R224 KDE Connect

REVISION DETAIL
  https://phabricator.kde.org/D7146

To: nicolasfella, #kde_connect, apol
Cc: thomasp, apol, #kde_connect, albertvaka, tfella, aboudhar, seebauer, progwolff, MayeulC, menasshock, ach, hkaelberer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/kdeconnect/attachments/20170805/e8cdd3b2/attachment.html>