From eb5cb1311ebc99b56c88750adf34b9fba833a5cf Mon Sep 17 00:00:00 2001
From: Kay0u <pierre@kayou.io>
Date: Tue, 14 Sep 2021 18:55:27 +0200
Subject: [PATCH 1/3] fix YNH_APP_BASEDIR during actions

---
 data/helpers.d/utils | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/helpers.d/utils b/data/helpers.d/utils
index 511fa52fb..ef019e894 100644
--- a/data/helpers.d/utils
+++ b/data/helpers.d/utils
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-YNH_APP_BASEDIR=$(realpath $([[ "$(basename $0)" =~ ^backup|restore$ ]] && echo '../settings' || echo '..'))
+YNH_APP_BASEDIR=$(realpath $([[ "$(basename $0)" =~ ^backup|restore$ ]] && echo '../settings' || [[ -n "$YNH_ACTION" ]] && echo '.' || echo '..' ))
 
 # Handle script crashes / failures
 #

From 0d702ed31ca164a234b983f31a7f3f7a0d90b108 Mon Sep 17 00:00:00 2001
From: Kay0u <pierre@kayou.io>
Date: Tue, 14 Sep 2021 18:57:08 +0200
Subject: [PATCH 2/3] run actions in tmp dir

---
 src/yunohost/app.py | 36 ++++++++++++++++++++++--------------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/src/yunohost/app.py b/src/yunohost/app.py
index d92aba373..49f2cd2ad 100644
--- a/src/yunohost/app.py
+++ b/src/yunohost/app.py
@@ -1651,25 +1651,35 @@ def app_action_run(operation_logger, app, action, args=None):
     )
     env_dict["YNH_ACTION"] = action
 
-    _, path = tempfile.mkstemp()
+    tmp_workdir_for_app = _make_tmp_workdir_for_app(app=app)
+    _, action_script = tempfile.mkstemp(dir=tmp_workdir_for_app)
 
-    with open(path, "w") as script:
+    with open(action_script, "w") as script:
         script.write(action_declaration["command"])
 
-    os.chmod(path, 700)
-
     if action_declaration.get("cwd"):
         cwd = action_declaration["cwd"].replace("$app", app)
     else:
-        cwd = os.path.join(APPS_SETTING_PATH, app)
+        cwd = tmp_workdir_for_app
 
-    # FIXME: this should probably be ran in a tmp workdir...
-    retcode = hook_exec(
-        path,
-        env=env_dict,
-        chdir=cwd,
-        user=action_declaration.get("user", "root"),
-    )[0]
+    try:
+        retcode = hook_exec(
+            action_script,
+            env=env_dict,
+            chdir=cwd,
+            user=action_declaration.get("user", "root"),
+        )[0]
+    # Here again, calling hook_exec could fail miserably, or get
+    # manually interrupted (by mistake or because script was stuck)
+    # In that case we still want to proceed with the rest of the
+    # removal (permissions, /etc/yunohost/apps/{app} ...)
+    except (KeyboardInterrupt, EOFError, Exception):
+        retcode = -1
+        import traceback
+
+        logger.error(m18n.n("unexpected_error", error="\n" + traceback.format_exc()))
+    finally:
+        shutil.rmtree(tmp_workdir_for_app)
 
     if retcode not in action_declaration.get("accepted_return_codes", [0]):
         msg = "Error while executing action '%s' of app '%s': return code %s" % (
@@ -1680,8 +1690,6 @@ def app_action_run(operation_logger, app, action, args=None):
         operation_logger.error(msg)
         raise YunohostError(msg, raw_msg=True)
 
-    os.remove(path)
-
     operation_logger.success()
     return logger.success("Action successed!")
 

From e15763f97b3979eb71461a04081cce798cd9b39f Mon Sep 17 00:00:00 2001
From: Kayou <pierre@kayou.io>
Date: Tue, 14 Sep 2021 19:11:05 +0200
Subject: [PATCH 3/3] Update src/yunohost/app.py

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>
---
 src/yunohost/app.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/yunohost/app.py b/src/yunohost/app.py
index 49f2cd2ad..b42bed925 100644
--- a/src/yunohost/app.py
+++ b/src/yunohost/app.py
@@ -1669,10 +1669,9 @@ def app_action_run(operation_logger, app, action, args=None):
             chdir=cwd,
             user=action_declaration.get("user", "root"),
         )[0]
-    # Here again, calling hook_exec could fail miserably, or get
+    # Calling hook_exec could fail miserably, or get
     # manually interrupted (by mistake or because script was stuck)
-    # In that case we still want to proceed with the rest of the
-    # removal (permissions, /etc/yunohost/apps/{app} ...)
+    # In that case we still want to delete the tmp work dir
     except (KeyboardInterrupt, EOFError, Exception):
         retcode = -1
         import traceback