Bug #65057 [NEW]: move_uploaded_file() umask acl

From: pb at complex dot pl Operating system: Linux PHP version: 5.3.26 Package: Filesystem function related Bug Type: Bug Bug description:move_uploaded_file() umask acl Description: ------------ move_uploaded_file() uses VCWD_CHMOD(new_path, 0666 & ~oldmask). This breaks acls of uploaded files when umask is set to 077 The setup is as follows: - all files are owned by user:user - all files have 600 perms, dirs have 700 - PHP script is invoked as user:user (suexec+fcgid) - ACLs are used to grant access for apache user (user:apache:r-x, default:user:apache:r-x) on all files and dirs. - umask set to 077 When file is uploaded to upload_tmp_dir getfacl shows: user::rw- user:apache:r-x #effective:r-- group::--- mask::r-- other::--- After calling move_uploaded_file() the file in dest_dir has following ACLs: user::rw- user:apache:r-x #effective:--- group::--- mask::--- other::--- chmod(600) invoked in this case in move_uploaded_file() changes ACL mask to 000 which in turn revokes access for apache user. Expected result: ---------------- Preserve ACL of uploaded files. Actual result: -------------- ACL get broken after calling move_uploaded_file() -- Edit bug report at https://bugs.php.net/bug.php?id=65057&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=65057&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=65057&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=65057&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=65057&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=65057&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=65057&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=65057&r=needscript Try newer version: https://bugs.php.net/fix.php?id=65057&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=65057&r=support Expected behavior: https://bugs.php.net/fix.php?id=65057&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=65057&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=65057&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=65057&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=65057&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=65057&r=dst IIS Stability: https://bugs.php.net/fix.php?id=65057&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=65057&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=65057&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=65057&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=65057&r=mysqlcfg