From 8d57e404d1e0d39df657522b5564e3e923cda9f3 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Tue, 3 Mar 2026 11:18:21 +0100 Subject: [PATCH] Fix umask and password memory wipe - Set umask(0077) in daemonize() to prevent world-readable files - Wipe password from memory after psync_set_user_pass() Fixes #203, #204 --- control_tools.cpp | 2 +- pclsync_lib.cpp | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/control_tools.cpp b/control_tools.cpp index 6186391..dc1b964 100644 --- a/control_tools.cpp +++ b/control_tools.cpp @@ -485,7 +485,7 @@ int daemonize(bool do_commands) { } /* Open any logs here */ - umask(0); + umask(0077); sid = setsid(); if (sid < 0) { exit(EXIT_FAILURE); diff --git a/pclsync_lib.cpp b/pclsync_lib.cpp index 5a007c1..10daf32 100644 --- a/pclsync_lib.cpp +++ b/pclsync_lib.cpp @@ -442,6 +442,7 @@ static void status_change(pstatus_t *status) { psync_set_user_pass(clib::pclsync_lib::get_lib().get_username().c_str(), clib::pclsync_lib::get_lib().get_password().c_str(), (int)clib::pclsync_lib::get_lib().save_pass_); + clib::pclsync_lib::get_lib().wipe_password(); std::cout << "logging in" << std::endl; } else if (status->status == PSTATUS_TFA_REQUIRED) { if (clib::pclsync_lib::get_lib().get_tfa_code().empty()) {