13 files changed, 32 insertions, 18 deletions
diff --git a/ChangeLog b/ChangeLog
index a7122841c..7ffa35e53 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2014-12-28  Barton E. Schaefer  <schaefer@zsh.org>
+
+	* 34068: Completion/Base/Widget/_complete_debug,
+	Completion/Unix/Command/_cvs, Completion/compinstall,
+	Functions/Calendar/calendar, Functions/Zftp/zfcd_match,
+	Functions/Zftp/zfcget, Functions/Zftp/zfcput,
+	Functions/Zftp/zfget_match, Functions/Zftp/zfrglob,
+	Functions/Zftp/zftransfer, Functions/Zftp/zfuget,
+	Functions/Zftp/zfuput: create tempfiles without forking, and
+	safe temp directory creation
+
 2014-12-27  Barton E. Schaefer  <schaefer@zsh.org>
 
 	* 34067: Completion/Base/Widget/_complete_debug,
diff --git a/Completion/Base/Widget/_complete_debug b/Completion/Base/Widget/_complete_debug
index 00f600e37..50fc8090a 100644
--- a/Completion/Base/Widget/_complete_debug
+++ b/Completion/Base/Widget/_complete_debug
@@ -9,7 +9,7 @@ local pager w="${(qq)words}"
 integer debug_fd=-1
 {
   if [[ -t 2 ]]; then
-    mv -f =(:) $tmp &&
+    mv -f =(<<<'') $tmp &&
     exec {debug_fd}>&2 2>| $tmp
   fi
 
diff --git a/Completion/Unix/Command/_cvs b/Completion/Unix/Command/_cvs
index 3c06e0481..31997ec09 100644
--- a/Completion/Unix/Command/_cvs
+++ b/Completion/Unix/Command/_cvs
@@ -704,15 +704,18 @@ _cvs_sub_modules() {
 _cvs_run() {
   local cvsroot="$1" dir="$2"
   shift 2
-  local d=/tmp/zsh-cvs-work-$$
-  mkdir $d >&/dev/null
-  cd $d
-  mkdir CVS >&/dev/null
+  local d=${TMPPREFIX:-/tmp/zsh}-cvs-work-$$
+  rm -rf $d
+  mkdir $d &&
+  (
+  chmod 0700 $d &&
+  builtin cd -q $d &&
+  mkdir CVS >&/dev/null || return 1
   print -r - "$cvsroot" > CVS/Root
   print "$dir" > CVS/Repository
   print D > CVS/Entries
   CVS_IGNORE_REMOTE_ROOT= cvs "$@"
-  cd $OLDPWD
+  )
   rm -rf $d
 }
 
diff --git a/Completion/compinstall b/Completion/compinstall
index 7d34ee4d8..ae94993d6 100644
--- a/Completion/compinstall
+++ b/Completion/compinstall
@@ -1958,8 +1958,8 @@ if [[ -z $ifile || -d $ifile ]] ||
 fi
 
 local tmpout=${TMPPREFIX:-/tmp/zsh}compinstall$$
-mv -f =(:) $tmpout &&	# safe tempfile creation
-mv -f =(:) ${tmpout}x || return 1
+mv -f =(<<<'') $tmpout &&	# safe tempfile creation
+mv -f =(<<<'') ${tmpout}x || return 1
 
 #
 # Assemble the complete set of lines to
diff --git a/Functions/Calendar/calendar b/Functions/Calendar/calendar
index 08c4250dc..39fc4313c 100644
--- a/Functions/Calendar/calendar
+++ b/Functions/Calendar/calendar
@@ -254,7 +254,7 @@ if (( verbose )); then
 fi
 
 local mycmds="${TMPPREFIX:-/tmp/zsh}.calendar_cmds.$$"
-mv -f =(:) $mycmds
+mv -f =(<<<'') $mycmds
 
 # start of subshell for OS file locking
 (
diff --git a/Functions/Zftp/zfcd_match b/Functions/Zftp/zfcd_match
index 2c809c20f..9159f496c 100644
--- a/Functions/Zftp/zfcd_match
+++ b/Functions/Zftp/zfcd_match
@@ -29,7 +29,7 @@ if [[ $ZFTP_SYSTEM = UNIX* ]]; then
 #  () {
 #    zftp ls -LF $dir >|$1
 #    reply=($(awk '/\/$/ { print substr($1, 1, length($1)-1) }' $1))
-#  } =(:)
+#  } =(<<<'')
   [[ -n $dir && $dir != */ ]] && dir="$dir/"
   if [[ -n $WIDGET ]]; then
     _wanted directories expl 'remote directory' \
diff --git a/Functions/Zftp/zfcget b/Functions/Zftp/zfcget
index 435980113..569ee9de1 100644
--- a/Functions/Zftp/zfcget
+++ b/Functions/Zftp/zfcget
@@ -43,7 +43,7 @@ for remlist in $*; do
 	  zftp remote $rem >|$1
 	  rstat=$?
 	  remst=($(<$1))
-	} =(: temporary file)
+	} =(<<<'temporary file')
 	if [[ $rstat = 2 ]]; then
 	  print "Server does not support SIZE command.\n" \
 	  "Assuming you know what you're doing..." 2>&1
diff --git a/Functions/Zftp/zfcput b/Functions/Zftp/zfcput
index 2cf8fe2d2..eafecde78 100644
--- a/Functions/Zftp/zfcput
+++ b/Functions/Zftp/zfcput
@@ -43,7 +43,7 @@ for loc in $*; do
       zftp remote $rem >|$1
       rstat=$?
       remst=($(<$1))
-    } =(: temporary file)
+    } =(<<<'temporary file')
     if [[ $rstat = 2 ]]; then
       print "Server does not support remote status commands.\n" \
       "You will have to find out the size by hand and use zftp append." 2>&1
diff --git a/Functions/Zftp/zfget_match b/Functions/Zftp/zfget_match
index c2871fa16..3ba06c47a 100644
--- a/Functions/Zftp/zfget_match
+++ b/Functions/Zftp/zfget_match
@@ -10,7 +10,7 @@ fi
 if [[ $ZFTP_SYSTEM == UNIX* && $1 == */* ]]; then
   setopt localoptions clobber
   local tmpf=${TMPPREFIX}zfgm$$
-  mv -f =(:) $tmpf
+  mv -f =(<<<'') $tmpf
 	
   if [[ -n $WIDGET ]]; then
     local dir=${1:h}
diff --git a/Functions/Zftp/zfrglob b/Functions/Zftp/zfrglob
index 5015be77b..677b85f4b 100644
--- a/Functions/Zftp/zfrglob
+++ b/Functions/Zftp/zfrglob
@@ -38,7 +38,7 @@ if [[ $zfrglob != '' ]]; then
   () {
     zftp ls "$pat" >|$1 2>/dev/null
     eval "$1=(\$(<\$1))"
-  } =(: temporary file)
+  } =(<<<'temporary file')
 else
   if [[ $ZFTP_SYSTEM = UNIX* && $pat = */* ]]; then
     # not the current directory and we know how to handle paths
@@ -52,7 +52,7 @@ else
     () {
       zftp ls "$dir" 2>/dev/null >|$1
       files=($(<$1))
-    } =(: temporary file)
+    } =(<<<'temporary file')
     files=(${files:t})
   else
     # we just have to do an ls and hope that's right
diff --git a/Functions/Zftp/zftransfer b/Functions/Zftp/zftransfer
index 432e2f584..c97ae4645 100644
--- a/Functions/Zftp/zftransfer
+++ b/Functions/Zftp/zftransfer
@@ -47,7 +47,7 @@ if [[ -n $style && $style != none ]]; then
   () {
     zftp remote $file1 >|$1 2>/dev/null
     array=($(<$1))
-  } =(: temporary file)
+  } =(<<<'temporary file')
   [[ $#array -eq 2 ]] && ZFTP_TSIZE=$array[1]
 fi
 
diff --git a/Functions/Zftp/zfuget b/Functions/Zftp/zfuget
index 7bdaedc47..2850975e7 100644
--- a/Functions/Zftp/zfuget
+++ b/Functions/Zftp/zfuget
@@ -72,7 +72,7 @@ for remlist in $*; do
 	  zftp remote $rem >|$1
 	  rstat=$?
 	  remstats=($(<$1))
-	} =(: temporary file)
+	} =(<<<'temporary file')
 	if [[ $rstat = 2 ]]; then
 	  print "Server does not implement full command set required." 1>&2
 	  return 1
diff --git a/Functions/Zftp/zfuput b/Functions/Zftp/zfuput
index 24a355931..f4e6a0fd6 100644
--- a/Functions/Zftp/zfuput
+++ b/Functions/Zftp/zfuput
@@ -58,7 +58,7 @@ for rem in $*; do
     zftp remote $rem >|$1
     rstat=$?
     remstats=($(<$1))
-  } =(: temporary file)
+  } =(<<<'temporary file')
   if [[ $rstat = 2 ]]; then
     print "Server does not implement full command set required." 1>&2
     return 1