HI Jim, I've patched my emacs-28 source and am compiling the whole beat right now. Once installed, I'll let you know :-) /PA On Sat, 30 Oct 2021 at 21:47, Jim Porter wrote: > On 10/30/2021 12:16 PM, Jim Porter wrote: > > On 10/30/2021 10:39 AM, Ulrich Mueller wrote: > >> There can be situations where there is an XDG environment for the client > >> but not for the daemon. > > > > Right, the patch in bug#33847 should handle that case correctly, but I'm > > pretty sure the current implementation opens users who spawn the Emacs > > daemon on-demand to symlink attacks. That's due to the code needing to > > check both XDG_RUNTIME_DIR and TMPDIR before being sure there's no > > daemon to connect to. > > > > I can think of two ways to avoid this issue: > [snip] > > 2) If XDG_RUNTIME_DIR and ALTERNATE_EDITOR/--alternate-editor are both > > set, never check TMPDIR. This should let both cases work without > > requiring users to explicitly set a flag anywhere, but it the lack of > > explicitness could be more confusing. I think this should work fine in > > all cases, since users running `emacs --daemon' without XDG probably > > won't be using ALTERNATE_EDITOR (the daemon should always be running, so > > there's no need for an alternate editor). > > I posted a patch for method (2) to bug#51327 here: > . > -- Fragen sind nicht da um beantwortet zu werden, Fragen sind da um gestellt zu werden Georg Kreisler