From 249df84a47e430fc0c3003c02b123d01a1d17b54 Mon Sep 17 00:00:00 2001
From: twouters
Date: Tue, 11 Mar 2003 00:40:10 +0000
Subject: While checking and re-checking the DESTDIR patch, I noticed this
 Makefile ran chmod before chown... It really shouldn't, since chmod'ing first
 opens up a security vulnerability, and chown can remove setuid bits. I'm also
 somewhat confused about the 'install' target installing the CGI executables
 and setting them g+s, and the 'finish' target chowning them and setting them
 u+s, but I left that part alone.

---
 src/Makefile.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Makefile.in b/src/Makefile.in
index 29918015a..7f120465c 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -122,8 +122,8 @@ finish:
 	-for f in $(SUID_CGI_PROGS); \
 	do \
 	    exe=$(DESTDIR)$(CGIDIR)/$$f$(CGIEXT); \
-	    chmod u+s $$exe; \
 	    chown $(MAILMAN_USER) $$exe; \
+	    chmod u+s $$exe; \
 	done
 
 clean:
-- 
cgit v1.3.1