[webgui] remove tmp html file after connection established

Temporary file required to start browser.
Then connection established - information is not longer necessary.
Also increase security.

Author: linev

gui/webdisplay/inc/ROOT/RWebDisplayHandle.hxx

@@ -109,6 +109,9 @@ public:
    /// resize web window - if possible
    virtual bool Resize(int, int) { return false; }
 
+   /// remove file which was used to startup widget - if possible
+   virtual void RemoveStartupFiles() {}
+
    static bool NeedHttpServer(const RWebDisplayArgs &args);
 
    static std::unique_ptr<RWebDisplayHandle> Display(const RWebDisplayArgs &args);

gui/webdisplay/src/RWebDisplayHandle.cxx

@@ -125,13 +125,15 @@ class RWebBrowserHandle : public RWebDisplayHandle {
    browser_process_id fPid;
 
 public:
-   RWebBrowserHandle(const std::string &url, const std::string &tmpdir, const std::string &tmpfile, const std::string &dump) :
-      RWebDisplayHandle(url), fTmpDir(tmpdir), fTmpFile(tmpfile)
+   RWebBrowserHandle(const std::string &url, const std::string &tmpdir, const std::string &tmpfile,
+                     const std::string &dump)
+      : RWebDisplayHandle(url), fTmpDir(tmpdir), fTmpFile(tmpfile)
    {
       SetContent(dump);
    }
 
-   RWebBrowserHandle(const std::string &url, const std::string &tmpdir, const std::string &tmpfile, browser_process_id pid)
+   RWebBrowserHandle(const std::string &url, const std::string &tmpdir, const std::string &tmpfile,
+                     browser_process_id pid)
       : RWebDisplayHandle(url), fTmpDir(tmpdir), fTmpFile(tmpfile), fHasPid(true), fPid(pid)
    {
    }
@@ -140,19 +142,30 @@ class RWebBrowserHandle : public RWebDisplayHandle {
    {
 #ifdef _MSC_VER
       if (fHasPid)
-         gSystem->Exec(("taskkill /F /PID "s + std::to_string(fPid) + " >NUL 2>NUL").c_str());
-      std::string rmdir = "rmdir /S /Q ", rmfile = "del /F ";
+         gSystem->Exec(("taskkill /F /PID " s + std::to_string(fPid) + " >NUL 2>NUL").c_str());
+      std::string rmdir = "rmdir /S /Q ";
 #else
       if (fHasPid)
          kill(fPid, SIGKILL);
-      std::string rmdir = "rm -rf ", rmfile = "rm -f ";
+      std::string rmdir = "rm -rf ";
 #endif
       if (!fTmpDir.empty())
          gSystem->Exec((rmdir + fTmpDir).c_str());
-      if (!fTmpFile.empty())
-         gSystem->Exec((rmfile + fTmpFile).c_str());
+      RemoveStartupFiles();
    }
 
+   void RemoveStartupFiles() override
+   {
+#ifdef _MSC_VER
+      std::string rmfile = "del /F ";
+#else
+      std::string rmfile = "rm -f ";
+#endif
+      if (!fTmpFile.empty()) {
+         gSystem->Exec((rmfile + fTmpFile).c_str());
+         fTmpFile.clear();
+      }
+   }
 };
 
 } // namespace ROOT

gui/webdisplay/src/RWebWindow.cxx

@@ -820,7 +820,7 @@ bool RWebWindow::ProcessWS(THttpCallArg &arg)
 
       for (auto &conn : fPendingConn)
          if (_CanTrustIn(conn, key, ntry, is_remote, true /* test_first_time */))
-             return true;
+            return true;
 
       return false;
    }
@@ -860,6 +860,9 @@ bool RWebWindow::ProcessWS(THttpCallArg &arg)
          // preserve key for longpoll or when with session key used for HMAC hash of messages
          // conn->fKey.clear();
          conn->ResetStamps();
+         // remove files which are required for startup
+         if (conn->fDisplayHandle)
+            conn->fDisplayHandle->RemoveStartupFiles();
          if (conn->fWasFirst)
             fConn.emplace(fConn.begin(), conn);
          else