From 85a88bcffe2d61d143b4f8c545bd28b152d8d05b Mon Sep 17 00:00:00 2001
From: Lubomir Rintel <lubo.rintel@gooddata.com>
Date: Wed, 3 Apr 2013 18:31:40 +0200
Subject: [PATCH 3/3] Use cache dir for classes too

Instead of attempting to write them next to source files.
Java 6 API does not allow for setting sane permissions (i.e. same as
those of a source file) and relying on defaults is a security hazard
which can lead to information disclosure, or, in case of a too relaxed
umask, arbitrary code execution.

Also, this will likely improve performance for non-privileged users
which can not write to their distribution's packaged jython tree.
---
 src/org/python/core/PySystemState.java |  6 ++++++
 src/org/python/core/imp.java           | 12 ++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/org/python/core/PySystemState.java b/src/org/python/core/PySystemState.java
index 9de34e3..a124228 100644
--- a/src/org/python/core/PySystemState.java
+++ b/src/org/python/core/PySystemState.java
@@ -539,6 +539,12 @@ public class PySystemState extends PyObject
     public static PackageManager packageManager;
     public static File cachedir;
     
+    public static File classCache() {
+        if (cachedir == null)
+	    return null;
+        return new File(cachedir, "classes");
+    }
+
     public static boolean isPackageCacheEnabled() {
         return cachedir != null;
     }
diff --git a/src/org/python/core/imp.java b/src/org/python/core/imp.java
index a9868dd..67c33d6 100644
--- a/src/org/python/core/imp.java
+++ b/src/org/python/core/imp.java
@@ -117,8 +117,15 @@ public class imp {
     }
 
     private static String makeCompiledFilename(String filename) {
-        return filename.substring(0, filename.length() - 3)
-                + "$py.class";
+	String basename = filename.substring(0, filename.length() - 3)
+                        + "$py.class";
+        File cache = Py.getSystemState().classCache();
+
+        if (cache == null) {
+            return basename;
+        } else {
+            return new File(cache, basename).getPath();
+        }
     }
     
     /**
@@ -144,6 +151,7 @@ public class imp {
         }
         FileOutputStream fop = null;
         try {
+            new File(compiledFilename).getParentFile().mkdirs();
             fop = new FileOutputStream(compiledFilename);
             fop.write(compiledSource);
             fop.close();
-- 
1.8.3.1