gently-rm: always resolve against a base directory

The amount that resolve() is used is probably overly cautious as-is, but
if we're going to use it, don't use it bare, or it will assume a base of
`process.cwd()`, which is often incorrect.

1 files changed, 6 insertions, 6 deletions

diff --git a/lib/utils/gently-rm.js b/lib/utils/gently-rm.js
index a7d30e3c8..1287707b8 100644
--- a/lib/utils/gently-rm.js
+++ b/lib/utils/gently-rm.js
@@ -15,7 +15,7 @@ var npm = require("../npm.js")
   , asyncMap = require("slide").asyncMap
   , normalize = require("path").normalize
 
-function gentlyRm (path, gently, base, cb) {
+function gentlyRm (target, gently, base, cb) {
   if (!cb) {
     cb = base
     base = undefined
@@ -40,7 +40,7 @@ function gentlyRm (path, gently, base, cb) {
     npm.globalBin
   ]
 
-  var resolved = normalize(resolve(path))
+  var resolved = normalize(resolve(npm.prefix, target))
   if (prefixes.indexOf(resolved) !== -1) {
     log.verbose("gentlyRm", resolved, "is part of npm and can't be removed")
     return cb(new Error("May not delete: "+resolved))
@@ -48,14 +48,14 @@ function gentlyRm (path, gently, base, cb) {
 
   var options = {log : log.silly.bind(log, "gentlyRm")}
   if (npm.config.get("force") || !gently) options.purge = true
-  if (base) options.base = normalize(base)
+  if (base) options.base = normalize(resolve(npm.prefix, base))
 
   if (!gently) {
     log.verbose("gentlyRm", "vacuuming", resolved)
     return vacuum(resolved, options, cb)
   }
 
-  var parent = options.base = normalize(base ? base : npm.prefix)
+  var parent = options.base = normalize(base ? resolve(npm.prefix, base) : npm.prefix)
 
   // is the parent directory managed by npm?
   log.silly("gentlyRm", "verifying", parent, "is an npm working directory")
@@ -122,7 +122,7 @@ function gentlyRm (path, gently, base, cb) {
           }
 
           log.verbose("gentlyRm", resolved, "is not under npm's control")
-          return clobberFail(path, parent, cb)
+          return clobberFail(target, parent, cb)
         })
       })
     })
@@ -154,7 +154,7 @@ function isManaged (target) {
   }
 
   function resolveSymlink (toResolve, cb) {
-    var resolved = resolve(toResolve)
+    var resolved = resolve(npm.prefix, toResolve)
 
     // if the path has already been memoized, return immediately
     var cached = resolvedPaths[resolved]