#41255 [NEW]: move_uploaded_file wrong permissions cgi

From: agrimm61 at gmail dot com Operating system: Linux PHP version: 4.4.6 PHP Bug Type: Filesystem function related Bug description: move_uploaded_file wrong permissions cgi Description: ------------ When moving an uploaded file with move_uploaded_file while php is running in cgi mode the originated file has permissions 600. copy() creates a file with the expected permissions 644. As a result the webserver isn't able to read the file. Safe_Mode is off! Reproduce code: --------------- <? echo umask(); copy($_FILES['userfile']['tmp_name'], "./".$_FILES['userfile']['name'].".copy"); move_uploaded_file($_FILES['userfile']['tmp_name'], "./".$_FILES['userfile']['name']); ?> Expected result: ---------------- output of 18 which is the right umask ( 022 ), so permissions should be set to 644. file moved by copy has permissions 644 file moved by move_uploaded_file has permissions 644 Actual result: -------------- output of 18 which is the right umask ( 022 ), so permissions should be set to 644. file moved by copy has permissions 644 file moved by move_uploaded_file has permissions 600 As a hint i added some lines in basic_functions.c to get the expected behaviour. Here is the patch : --- ext/standard/basic_functions.c.orig 2007-01-01 10:46:47.000000000 +0100 +++ ext/standard/basic_functions.c 2007-05-02 01:43:22.000000000 +0200 @@ -2867,10 +2867,12 @@ VCWD_UNLINK(Z_STRVAL_PP(new_path)); if (rename(Z_STRVAL_PP(path), Z_STRVAL_PP(new_path)) == 0) { + VCWD_CHMOD(Z_STRVAL_PP(new_path),420); successful = 1; } else if (php_copy_file(Z_STRVAL_PP(path), Z_STRVAL_PP(new_path) TSRMLS_CC) == SUCCESS) { VCWD_UNLINK(Z_STRVAL_PP(path)); + VCWD_CHMOD(Z_STRVAL_PP(new_path),420); successful = 1; } -- Edit bug report at http://bugs.php.net/?id=41255&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41255&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41255&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41255&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41255&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41255&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41255&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41255&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41255&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41255&r=support Expected behavior: http://bugs.php.net/fix.php?id=41255&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41255&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41255&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41255&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41255&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41255&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41255&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41255&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41255&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41255&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41255&r=mysqlcfg