uploading files permission 600 in php v5.2.5 - bug?

[tobi]

Hi folks,

i did a fresh, clean install with GS 2.01 on a friend's server (php v5.2.5). After Uploading files in the FILES tab i had no read permissions. In Transmit I checked the permissions: 600 ! My friend said it could be a bug in his php version, which is fixed in 5.2.8:

"Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov")
http://www.howtoforge.com/forums/showthr...p?p=221273

He told me to change /admin/upload.php and admin/upload-ajax.php and add a line of php-code after the move_uploaded_file line:


//create file
move_uploaded_file($_FILES["file"]["tmp_name"], $file_loc);

// Set temporary to have the correct permissions
chmod($targetFile, 0644);


I changed it, an the permissions are now okay. I will post this here, so you can tell me if it is a bug in GS or still a wrong configuration in my scripts or something else!

Greetings from Dresden
Tobias

[Zegnåt]

I’ve never seen this happen before, neither have I heard of it, so it might very well be a PHP problem. It’s great to see you have a solution to share though!

If we hear from others that this is a problem they’re experiencing we’ll take the chmod() line up in the core. Thanks!

[internet54]

I don't think this is a bug more than a security issue. Nearly all servers are set to auto set file permissions to 0644 and folder permissions to 0755. I would have him check the server out.

[sal]

I have also experienced this with both 2.0 and 2.0.1 but will apply the fix detailed above.

Edit: Now works perfectly.

[mytest13]

Hello,
I had the same problem. After using your fix, file now have permission 0644. But They are still not shown on the webpage, if I use the direct URL i get 403-error. The file owner is the same as all getsimple-files (ftp-user).

So what can be wrong now?

Many thanks for your answers.
mytest13

[Joshas]

Getting the same upload permissions issue with GetSimple 2.03 on PHP 5.1.6 server. Maybe it would be a good idea to include this patch in next GetSimple release?

[ccagle8]

so you added the chmod function to your upload.php and it fixed your issue?

[Joshas]

I've added

Code:

// Set temporary to have the correct permissions  
chmod($targetFile, 0644);

to /admin/upload-ajax.php right after
move_uploaded_file($tempFile, $targetFile);
line and uploaded images show up correctly. Tested on GetSimple version 2.03.