[server] .tmp avatar file leaks on disk if fs::rename fails #31

New Issue

2026-05-19T18:44:35Z

funman300 commented

2026-05-19 18:44:35 +00:00

File

solitaire_server/src/auth.rs lines 392–393

Description

upload_avatar writes to <user_id>.<ext>.tmp then renames to <user_id>.<ext>. If rename fails (cross-device move, permission error), the function returns an error and the .tmp file remains on disk permanently. The server has no periodic cleanup, unlike the client which calls cleanup_orphaned_tmp_files() at startup. Repeated failed uploads accumulate stale tmp files and leak disk space.

Fix

In the error branch after a failed rename, add let _ = std::fs::remove_file(&tmp_path); to clean up the temp file.

## File `solitaire_server/src/auth.rs` lines 392–393 ## Description `upload_avatar` writes to `<user_id>.<ext>.tmp` then renames to `<user_id>.<ext>`. If `rename` fails (cross-device move, permission error), the function returns an error and the `.tmp` file remains on disk permanently. The server has no periodic cleanup, unlike the client which calls `cleanup_orphaned_tmp_files()` at startup. Repeated failed uploads accumulate stale tmp files and leak disk space. ## Fix In the error branch after a failed rename, add `let _ = std::fs::remove_file(&tmp_path);` to clean up the temp file.

funman300 referenced this issue from a commit

2026-05-19 20:15:26 +00:00

fix(multi): resolve 26 bugs found in comprehensive codebase review

funman300 closed this issue

2026-05-19 20:20:23 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: funman300/Ferrous-Solitaire#31