Repository navigation
Never write the log through a planted link, and show the release version in the app header - #12
Merged
Merged
Conversation
The logs folder stays user-writable for user-context runs, and dialog.exe can run as SYSTEM. FileLog now removes any symbolic link or junction between the data root and the log before creating anything, opens the log without following a reparse point, and replaces a log that is a link or has a second name (a hard link) with a fresh file. SafeLogFile is copied from manageusers.
The Prefs header read a BuildTimestamp stamped at compile time. It now shows the informational version without its +sha suffix, zero-padded to YYYY.MM.DD.HHMM. build.ps1 takes -Version, and the release workflow passes the tag, so the header, the MSI and the .pkg all carry the release version.
rodchristiansen
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
%ProgramData%\ManagedNotifications\logsstays user-writable so user-context dialog runs can log. dialog.exe can also run as SYSTEM, for example when a management tool calls it before anyone signs in. A link a user left inlogswould then turn the log append into a SYSTEM write somewhere else.What
SafeLogFile(copied from manageusers):RemoveLinksdeletes any symbolic link or junction from the data root down to the log. Only the link goes, never its target.OpenAppendopens withFILE_FLAG_OPEN_REPARSE_POINT. If the file is a reparse point or has more than one name (a hard link), it deletes that name and creates a new file.FileLog.WritecallsRemoveLinksbefore it creates the folder, migrates or rotates, then appends throughOpenAppendinstead ofFile.AppendAllText. The line format, rotation and never-throw behaviour are unchanged.Tests
32 pass. There are 7 new tests:
FileLogitself: a hard-linked log file, and a junctionedlogsfolder.FileLogtests share a collection so the static log path is not changed while another test reads it.Also: release version in the header
BuildTimestampstamped at compile time. It now showsAssemblyInformationalVersionwith the+shasuffix stripped, zero-padded toYYYY.MM.DD.HHMM(ReleaseVersion.Display, 7 tests). This matches crypt-escrow Prefs: replace the Managed badge with one policy note and list installed services #19.build.ps1 -Versionsets the release version, andrelease.ymlpasses the tag, so the header, MSI and .pkg carry the tag rather than the build time. With no-Versionit falls back to the current time, as before.build.ps1 -Msi -Version 2026.10.06.2105produces an app whose ProductVersion is2026.10.06.2105+<sha>, which the header shows as2026.10.06.2105. The suite now has 39 passing tests.