You *must* use O_EXCL when using mktemp (security issue).

Glad this code never shipped :-).
This is not a problem in 2.0.x.
Jeremy.
(This used to be commit a0c302f4d03ab07d697115fa8520d0cb0b2ba616)

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index b4aefe44c174245f41f79d6738e3392a093345f9..ef0b7fad9b1281d3797fbc349499357a08acc500 100644 (file)
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -2596,7 +2596,7 @@ uint32 _spoolss_startdocprinter( const POLICY_HND *handle, uint32 level,
        slprintf(tempname,sizeof(tempname)-1, "%s/smb_print.XXXXXX",lp_pathname(snum));  
        pstrcpy(fname, (char *)mktemp(tempname));
 
-       fd=open(fname, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR );
+       fd=open(fname, O_WRONLY|O_CREAT|O_TRUNC|O_EXCL, S_IRUSR|S_IWUSR );
        DEBUG(4,("Temp spool file created: [%s]\n", fname));
 
        Printer->current_jobid=fd;