The "release-history" directory is not automatically created if i save settings or execute project-release-history.php.

Does this make any sense and is this intended?

Comments

dww’s picture

dww
we/he/they
commented
Title: release-history directory not automatically created » release-history directory not created by project-release-history.php
Priority: Normal » Minor

The script itself could test this and create the directory, perhaps.

No way should this happen when you save project-related settings in your Drupal site, since this is not part of drupal. This directory should *not* be writable by the web. It should be created, and only writable by a different user, the one that runs the CLI cron job (outside of Drupal).

So, if you want to patch the script itself to check if the dir exists, and if not, attempt a mkdir(), that'd be fine, thanks. Nothing else belongs in this issue. Well, I guess the settings page could validate that the directory exists, too, but it definitely should *not* check for writability, and it definitely should *not* attempt to create the directory itself.

Cheers,
-Derek

hass’s picture

hass commented

But isn't not every subdirectory in "files" automatically writable?

In this case the script and project setting page may create the directory and set the appropriate permissions if the directory does not exists. not sure if this is save enough. Your security eyes are talking about users that may write or overwrite xml files in the history directory if they will upload files?

dww’s picture

dww
we/he/they
commented
Title: release-history directory not created by project-release-history.php » release-history directory not created by project-release-create-history.php
Version: 5.x-1.x-dev » 6.x-1.x-dev
Component: Projects » Releases
Assigned: Unassigned » dww
Status: Active » Fixed

There's no reason to force the XML history directory to live as a subdir of the main Drupal files tree. It can (and in some cases, should) live completely outside of the main webroot. So, instead of forcing it through file_create_path(), there's now just a configuration constant at the top of the script (just like in project-release-serve-history.php).

Also, the script now attempts to create this directory for you if it doesn't exist, and only exits with an error if mkdir() fails.

Committed these to HEAD: http://drupal.org/cvs?commit=247938

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.