avoid symlink attacks in __fish_print_packages and spawning fishd

 * use $XDG_CACHE_HOME for __fish_print_packages completion caches
 * when starting fishd, redirect fishd output to /dev/null, not a
   predictable path

Fix for CVE-2014-3219.

Closes #1440.

1 files changed, 1 insertions, 1 deletions

diff --git a/env.cpp b/env.cpp
index ff62a53f..086f181a 100644
--- a/env.cpp
+++ b/env.cpp
@@ -58,7 +58,7 @@
 #include "fish_version.h"
 
 /** Command used to start fishd */
-#define FISHD_CMD L"fishd ^ /tmp/fishd.log.%s"
+#define FISHD_CMD L"fishd ^ /dev/null"
 
 // Version for easier debugging
 //#define FISHD_CMD L"fishd"