Download & Extend

Fix file permissions of server generated files

Project:Image Assist
Version:5.x-1.x-dev
Component:Code
Category:bug report
Priority:normal
Assigned:Unassigned
Status:closed (fixed)

Issue Summary

On servers with tight umasks files generated by server scripts are not automatically readable by the web server itself. This causes problems where an upload itself works fine, but generated image derivatives do not display. The simplest workaround for this is to simply chmod server generated files to a more open mask.

This is exactly what Drupal core does in several places (see color.module, for example in http://drupal.org/node/119196) - this is perhaps suboptimal security wise, but until there is a standard 'fix_file_perms' function in core it's what we have.

Here is a patch that does exactly what color module does with img_assist module generated files.

AttachmentSize
img_assist_chmod_0.patch771 bytes

Comments

#1

Looks good, but how can I test this patch?

#2

I had the same problem Grugnog2 did (FreeBSD 7, Apache 2.2.9). For the life of me I could not figure out how to change the umask in Apache (not even sure you can anymore).

Anyway, I applied Grugnog2's patch by hand to IA version 6.x-2.x-dev (just added the @chmod line in the appropriate place). It works. IA derivatives are now created with the appropriate permissions (rw-rw-r--) and Apache can read them.

I humbly request you add the @chmod line to the official IA source so I don't have to patch it every time a new version comes out. ;)

#3

Status:needs review» reviewed & tested by the community

#4

Status:reviewed & tested by the community» fixed

Committed slightly improved patch to all branches.

AttachmentSize
img_assist-DRUPAL-5.chmod_.patch 2.02 KB

#5

Status:fixed» closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

nobody click here