Re: Insecure tempfile creation

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Dec 22, 11:01pm, Mikael Magnusson wrote:
}
} Your first patch is not the best version of that solution;
} 
} +() {
} +  ${=${VISUAL:-${EDITOR:-vi}}} $1
} +  BUFFER="$(<$1)"
} +} =(print -R "$PREBUFFER$BUFFER")

Even that isn't the best formulation, =(<<<"$PREBUFFER$BUFFER") would
avoid forking the print.

} I don't know what the exec </dev/tty is for, but it can be added back
} if it's needed. I've used this patch for two years and never noticed
} any problems though.

Widgets run with stdin closed, so if the chosen editor doesn't open the
tty or one of the other std*s directly, it breaks without </dev/tty.