diff --git a/core/lib/Drupal/Component/PhpStorage/FileStorage.php b/core/lib/Drupal/Component/PhpStorage/FileStorage.php index d588af4..5f23cad 100644 --- a/core/lib/Drupal/Component/PhpStorage/FileStorage.php +++ b/core/lib/Drupal/Component/PhpStorage/FileStorage.php @@ -109,7 +109,7 @@ class FileStorage implements PhpStorageInterface { protected function unlink($path) { if (file_exists($path)) { // Ensure the file / folder is writable. - chmod($path, 0700); + chmod($path, 0777 & ~umask()); if (is_dir($path)) { $dir = dir($path); while (($entry = $dir->read()) !== FALSE) { diff --git a/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php index 4d564fb..7febbc7 100644 --- a/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php +++ b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php @@ -81,7 +81,7 @@ class MTimeProtectedFastFileStorage extends FileStorage { if (!@file_put_contents($temporary_path, $data)) { return FALSE; } - chmod($temporary_path, 0400); + chmod($temporary_path, 0444 & ~umask()); // Prepare a directory dedicated for just this file. Ensure it has a current // mtime so that when the file (hashed on that mtime) is moved into it, the @@ -107,7 +107,7 @@ class MTimeProtectedFastFileStorage extends FileStorage { $i = 0; while (($mtime = $this->getUncachedMTime($directory)) && ($mtime != $previous_mtime)) { $previous_mtime = $mtime; - chmod($directory, 0700); + chmod($directory, 0777 & ~umask()); // Reset the file back in the temporary location if this is not the first // iteration. if ($i > 0) { @@ -124,7 +124,7 @@ class MTimeProtectedFastFileStorage extends FileStorage { // Leave the directory neither readable nor writable. Since the file // itself is not writable (set to 0400 at the beginning of this function), // there's no way to tamper with it without access to change permissions. - chmod($directory, 0100); + chmod($directory, 0111 & ~umask()); $i++; } return TRUE; @@ -147,12 +147,12 @@ class MTimeProtectedFastFileStorage extends FileStorage { */ protected function ensureDirectory() { if (!file_exists($this->directory)) { - mkdir($this->directory, 0700, TRUE); + mkdir($this->directory, 0777 & ~umask(), TRUE); } - chmod($this->directory, 0700); + chmod($this->directory, 0777 & ~umask()); $htaccess_path = $this->directory . '/.htaccess'; if (!file_exists($htaccess_path) && file_put_contents($htaccess_path, self::HTACCESS)) { - @chmod($htaccess_path, 0444); + @chmod($htaccess_path, 0444 & ~umask()); } } @@ -163,7 +163,7 @@ class MTimeProtectedFastFileStorage extends FileStorage { * The directory to be emptied out. */ protected function cleanDirectory($directory) { - chmod($directory, 0700); + chmod($directory, 0777 & ~umask()); foreach (new DirectoryIterator($directory) as $fileinfo) { if (!$fileinfo->isDot()) { $this->unlink($fileinfo->getPathName());