--- cvs-1.11.19/src/filesubr.c.orig	2004-11-04 01:19:51 +0300

+++ cvs-1.11.19/src/filesubr.c	2005-04-06 18:47:15 +0400

@@ -990,6 +990,11 @@ last_component (path)

    The workaround is to put -f in inetd.conf which means that

    get_homedir won't get called until after the switch in user ID.

+   NOTE: the above paragraph is not sufficient if the HOME environment

+   variable is set, it overrides the uid based password lookup, hence

+   the change_uid logic path that blocks the HOME environment variable

+   when the uid gets changed.

+

    The whole concept of a "home directory" on the server is pretty

    iffy, although I suppose some people probably are relying on it for

    .cvsrc and such, in the cases where it works.  */

@@ -997,9 +1002,18 @@ char *

 get_homedir ()

 {

     static char *home = NULL;

+    static uid_t home_uid = -1;

+    static int changed_uid = 0;

+    uid_t uid = getuid();

     char *env;

     struct passwd *pw;

+    if (home && home_uid != -1 && home_uid != uid) {

+	home = 0;

+	changed_uid = 1;

+    }

+    home_uid = uid;

+

     if (home != NULL)

 	return home;

@@ -1007,9 +1021,10 @@ get_homedir ()

 #ifdef SERVER_SUPPORT

 	!server_active &&

 #endif

+	!changed_uid &&

 	(env = getenv ("HOME")) != NULL)

 	home = env;

-    else if ((pw = (struct passwd *) getpwuid (getuid ()))

+    else if ((pw = (struct passwd *) getpwuid (uid))

 	     && pw->pw_dir)

 	home = xstrdup (pw->pw_dir);

     else