diff --git a/admin/tool/customlang/locallib.php b/admin/tool/customlang/locallib.php index 24927309448..02ae558dcb8 100644 --- a/admin/tool/customlang/locallib.php +++ b/admin/tool/customlang/locallib.php @@ -323,6 +323,7 @@ EOF fwrite($f, ";\n"); } fclose($f); + @chmod($filepath, $CFG->filepermissions); } /** diff --git a/backup/cc/cc112moodle.php b/backup/cc/cc112moodle.php index eb15d00c646..9e11533f6f5 100644 --- a/backup/cc/cc112moodle.php +++ b/backup/cc/cc112moodle.php @@ -66,7 +66,7 @@ class cc112moodle extends cc2moodle { $cdir = static::$path_to_manifest_folder . DIRECTORY_SEPARATOR . 'course_files'; if (!file_exists($cdir)) { - mkdir($cdir); + mkdir($cdir, $CFG->directorypermissions, true); } $sheet_base = static::loadsheet(SHEET_BASE); diff --git a/backup/cc/cc2moodle.php b/backup/cc/cc2moodle.php index 05e8239f12d..332a9562185 100644 --- a/backup/cc/cc2moodle.php +++ b/backup/cc/cc2moodle.php @@ -149,7 +149,7 @@ class cc2moodle { $cdir = static::$path_to_manifest_folder . DIRECTORY_SEPARATOR . 'course_files'; if (!file_exists($cdir)) { - mkdir($cdir); + mkdir($cdir, $CFG->directorypermissions, true); } $sheet_base = static::loadsheet(SHEET_BASE); diff --git a/backup/cc/cc_lib/cc_utils.php b/backup/cc/cc_lib/cc_utils.php index 5bb6a30d0a9..39e70622562 100644 --- a/backup/cc/cc_lib/cc_utils.php +++ b/backup/cc/cc_lib/cc_utils.php @@ -63,11 +63,13 @@ abstract class cc_helpers { * @return mixed - directory short name or false in case of faliure */ public static function randomdir($where, $prefix = '', $suffix = '') { + global $CFG; + $dirname = false; $randomname = self::uuidgen($prefix, $suffix, false); $newdirname = $where.DIRECTORY_SEPARATOR.$randomname; if (mkdir($newdirname)) { - chmod($newdirname, 0755); + chmod($newdirname, $CFG->directorypermissions); $dirname = $randomname; } return $dirname; @@ -155,6 +157,8 @@ abstract class cc_helpers { } public static function add_files(cc_i_manifest &$manifest, $packageroot, $outdir, $allinone = true) { + global $CFG; + if (pkg_static_resources::instance()->finished) { return; } @@ -170,7 +174,7 @@ abstract class cc_helpers { //let us try to recreate them $justdir = $rdir->fullpath(false).$values[7]; if (!file_exists($justdir)) { - if (!mkdir($justdir, 0777, true)) { + if (!mkdir($justdir, $CFG->directorypermissions, true)) { throw new RuntimeException('Unable to create directories!'); } } diff --git a/backup/cc/cc_lib/gral_lib/pathutils.php b/backup/cc/cc_lib/gral_lib/pathutils.php index 346ae14e54a..0ff1cd985a4 100644 --- a/backup/cc/cc_lib/gral_lib/pathutils.php +++ b/backup/cc/cc_lib/gral_lib/pathutils.php @@ -156,6 +156,7 @@ function pathDiff($path1, $path2) { */ function copyr($source, $dest) { + global $CFG; // Simple copy for a file if (is_file($source)) { return copy($source, $dest); @@ -163,7 +164,7 @@ function pathDiff($path1, $path2) { // Make destination directory if (!is_dir($dest)) { - mkdir($dest); + mkdir($dest, $CFG->directorypermissions, true); } // Loop through the folder diff --git a/backup/cc/entities.class.php b/backup/cc/entities.class.php index e0737fdca11..c9e55264508 100644 --- a/backup/cc/entities.class.php +++ b/backup/cc/entities.class.php @@ -266,7 +266,7 @@ class entities { $fpath = $dpath . DIRECTORY_SEPARATOR . $rfpath; if (!file_exists($dpath)) { - mkdir($dpath); + mkdir($dpath, $CFG->directorypermissions, true); } //copy the folder.gif file $folder_gif = "{$CFG->dirroot}/pix/i/files.gif"; diff --git a/backup/cc/entities11.class.php b/backup/cc/entities11.class.php index e9873da72a6..b5b2f782c99 100644 --- a/backup/cc/entities11.class.php +++ b/backup/cc/entities11.class.php @@ -65,7 +65,7 @@ class entities11 extends entities { $rfpath = 'files.gif'; $fpath = $dpath . DIRECTORY_SEPARATOR . 'files.gif'; if (!file_exists($dpath)) { - mkdir($dpath); + mkdir($dpath, $CFG->directorypermissions, true); } //copy the folder.gif file $folder_gif = "{$CFG->dirroot}/pix/i/files.gif"; diff --git a/backup/converter/imscc11/backuplib.php b/backup/converter/imscc11/backuplib.php index ef876003735..b6d7154f8ba 100644 --- a/backup/converter/imscc11/backuplib.php +++ b/backup/converter/imscc11/backuplib.php @@ -141,7 +141,7 @@ class imscc11_backup_convert extends backup_execution_step { $tempdir = $CFG->dataroot . '/temp/backup/' . uniqid('', true); - if (mkdir($tempdir, 0777, true)) { + if (mkdir($tempdir, $CFG->directorypermissions, true)) { cc_convert_moodle2::convert($basepath, $tempdir); //Switch the directories diff --git a/backup/util/helper/backup_helper.class.php b/backup/util/helper/backup_helper.class.php index efc0c498635..87b6ebaa968 100644 --- a/backup/util/helper/backup_helper.class.php +++ b/backup/util/helper/backup_helper.class.php @@ -259,7 +259,7 @@ abstract class backup_helper { if (@rename($filepath, $filedest)) { return null; } - umask(0000); + umask($CFG->umaskpermissions); if (copy($filepath, $filedest)) { @chmod($filedest, $CFG->filepermissions); // may fail because the permissions may not make sense outside of dataroot unlink($filepath); diff --git a/cache/locallib.php b/cache/locallib.php index 860fb376963..71fce8185bd 100644 --- a/cache/locallib.php +++ b/cache/locallib.php @@ -108,6 +108,7 @@ class cache_config_writer extends cache_config { fflush($handle); fclose($handle); $locking->unlock('configwrite', 'config'); + @chmod($cachefile, $CFG->filepermissions); // Tell PHP to recompile the script. core_component::invalidate_opcode_php_cache($cachefile); } else { diff --git a/cache/stores/file/lib.php b/cache/stores/file/lib.php index 455665817eb..96d11b29ed6 100644 --- a/cache/stores/file/lib.php +++ b/cache/stores/file/lib.php @@ -720,6 +720,7 @@ class cachestore_file extends cache_store implements cache_is_key_aware, cache_i // Finally rename the temp file to the desired file, returning the true|false result. $result = rename($tempfile, $file); + @chmod($file, $this->cfg->filepermissions); if (!$result) { // Failed to rename, don't leave files lying around. @unlink($tempfile); diff --git a/files/externallib.php b/files/externallib.php index 54cb292a850..f2b0ab6f92d 100644 --- a/files/externallib.php +++ b/files/externallib.php @@ -263,6 +263,7 @@ class core_files_external extends external_api { } file_put_contents($savedfilepath, base64_decode($fileinfo['filecontent'])); + @chmod($savedfilepath, $CFG->filepermissions); unset($fileinfo['filecontent']); if (!empty($fileinfo['filepath'])) { diff --git a/lib/adminlib.php b/lib/adminlib.php index d4f8853a5df..3b37521e03d 100644 --- a/lib/adminlib.php +++ b/lib/adminlib.php @@ -626,6 +626,7 @@ function is_dataroot_insecure($fetchtest=false) { $testfile = $CFG->dataroot.'/diag/public.txt'; if (!file_exists($testfile)) { file_put_contents($testfile, 'test file, do not delete'); + @chmod($testfile, $CFG->filepermissions); } $teststr = trim(file_get_contents($testfile)); if (empty($teststr)) { diff --git a/lib/dml/sqlite3_pdo_moodle_database.php b/lib/dml/sqlite3_pdo_moodle_database.php index 7391954340d..d5a0080bc05 100644 --- a/lib/dml/sqlite3_pdo_moodle_database.php +++ b/lib/dml/sqlite3_pdo_moodle_database.php @@ -87,13 +87,15 @@ class sqlite3_pdo_moodle_database extends pdo_moodle_database { * @return bool success */ public function create_database($dbhost, $dbuser, $dbpass, $dbname, array $dboptions=null) { + global $CFG; + $this->dbhost = $dbhost; $this->dbuser = $dbuser; $this->dbpass = $dbpass; $this->dbname = $dbname; $filepath = $this->get_dbfilepath(); $dirpath = dirname($filepath); - @mkdir($dirpath); + @mkdir($dirpath, $CFG->directorypermissions, true); return touch($filepath); } diff --git a/lib/dtl/file_xml_database_exporter.php b/lib/dtl/file_xml_database_exporter.php index 498609f3d30..b92b488ad41 100644 --- a/lib/dtl/file_xml_database_exporter.php +++ b/lib/dtl/file_xml_database_exporter.php @@ -65,9 +65,11 @@ class file_xml_database_exporter extends xml_database_exporter { * @param string $description a user description of the data. */ public function export_database($description=null) { + global $CFG; // TODO: add exception if file creation fails $this->file = fopen($this->filepath, 'wb'); parent::export_database($description); fclose($this->file); + @chmod($this->filepath, $CFG->filepermissions); } } diff --git a/lib/filelib.php b/lib/filelib.php index 669542564a7..79464ca400f 100644 --- a/lib/filelib.php +++ b/lib/filelib.php @@ -2544,6 +2544,7 @@ function put_records_csv($file, $records, $table = NULL) { } fclose($fp); + @chmod($CFG->tempdir.'/'.$file, $CFG->filepermissions); return true; } @@ -3714,6 +3715,7 @@ class curl_cache { $fp = fopen($this->dir.$filename, 'w'); fwrite($fp, serialize($val)); fclose($fp); + @chmod($this->dir.$filename, $CFG->filepermissions); } /** diff --git a/lib/filestorage/file_storage.php b/lib/filestorage/file_storage.php index 967a3298e71..31fd1fbf93c 100644 --- a/lib/filestorage/file_storage.php +++ b/lib/filestorage/file_storage.php @@ -64,6 +64,8 @@ class file_storage { * @param int $filepermissions new file permissions */ public function __construct($filedir, $trashdir, $tempdir, $dirpermissions, $filepermissions) { + global $CFG; + $this->filedir = $filedir; $this->trashdir = $trashdir; $this->tempdir = $tempdir; @@ -79,6 +81,7 @@ class file_storage { if (!file_exists($this->filedir.'/warning.txt')) { file_put_contents($this->filedir.'/warning.txt', 'This directory contains the content of uploaded files and is controlled by Moodle code. Do not manually move, change or rename any of the files and subdirectories here.'); + chmod($this->filedir.'/warning.txt', $CFG->filepermissions); } } // make sure the file pool directory exists diff --git a/lib/installlib.php b/lib/installlib.php index 4bf474ea7dc..461f552ff84 100644 --- a/lib/installlib.php +++ b/lib/installlib.php @@ -93,7 +93,7 @@ function install_init_dataroot($dataroot, $dirpermissions) { return false; } - umask(0000); + umask(0000); // $CFG->umaskpermissions is not set yet. if (!file_exists($dataroot)) { if (!mkdir($dataroot, $dirpermissions, true)) { // most probably this does not work, but anyway diff --git a/lib/moodlelib.php b/lib/moodlelib.php index 997048e6485..ac38fc845ba 100644 --- a/lib/moodlelib.php +++ b/lib/moodlelib.php @@ -7263,6 +7263,7 @@ class core_string_manager implements string_manager { collatorlib::asort($languages); check_dir_exists(dirname($this->menucache), true, true); file_put_contents($this->menucache, json_encode($languages)); + @chmod($this->menucache, $CFG->filepermissions); } } diff --git a/lib/pluginlib.php b/lib/pluginlib.php index d100b9e4d7c..cf7e1464d04 100644 --- a/lib/pluginlib.php +++ b/lib/pluginlib.php @@ -2205,6 +2205,7 @@ class available_update_deployer { if (!file_exists($filepath)) { $success = file_put_contents($filepath, $password . PHP_EOL . $now . PHP_EOL, LOCK_EX); + chmod($filepath, $CFG->filepermissions); } } diff --git a/lib/setup.php b/lib/setup.php index 76dcf9eefac..acc466adfc9 100644 --- a/lib/setup.php +++ b/lib/setup.php @@ -298,8 +298,12 @@ if (!isset($CFG->directorypermissions)) { if (!isset($CFG->filepermissions)) { $CFG->filepermissions = ($CFG->directorypermissions & 0666); // strip execute flags } -// better also set default umask because recursive mkdir() does not apply permissions recursively otherwise -umask(0000); +// Better also set default umask because developers often forget to include directory +// permissions in mkdir() and chmod() after creating new files. +if (!isset($CFG->umaskpermissions)) { + $CFG->umaskpermissions = (($CFG->directorypermissions & 0777) ^ 0777); +} +umask($CFG->umaskpermissions); // exact version of currently used yui2 and 3 library $CFG->yui2version = '2.9.0'; diff --git a/lib/setuplib.php b/lib/setuplib.php index 81ebd50e205..360eccb1a13 100644 --- a/lib/setuplib.php +++ b/lib/setuplib.php @@ -1224,7 +1224,7 @@ function upgrade_ensure_not_running($warningonly = false) { function check_dir_exists($dir, $create = true, $recursive = true) { global $CFG; - umask(0000); // just in case some evil code changed it + umask($CFG->umaskpermissions); if (is_dir($dir)) { return true; @@ -1256,7 +1256,7 @@ function make_writable_directory($dir, $exceptiononerror = true) { } } - umask(0000); // just in case some evil code changed it + umask($CFG->umaskpermissions); if (!file_exists($dir)) { if (!mkdir($dir, $CFG->directorypermissions, true)) { @@ -1287,11 +1287,13 @@ function make_writable_directory($dir, $exceptiononerror = true) { * @param string $dir the full path of the directory to be protected */ function protect_directory($dir) { + global $CFG; // Make sure a .htaccess file is here, JUST IN CASE the files area is in the open and .htaccess is supported if (!file_exists("$dir/.htaccess")) { if ($handle = fopen("$dir/.htaccess", 'w')) { // For safety @fwrite($handle, "deny from all\r\nAllowOverride None\r\nNote: this file is broken intentionally, we do not want anybody to undo it in subdirectory!\r\n"); @fclose($handle); + @chmod("$dir/.htaccess", $CFG->filepermissions); } } } diff --git a/lib/uploadlib.php b/lib/uploadlib.php index 7ee20cfeec8..f6bc851ef22 100644 --- a/lib/uploadlib.php +++ b/lib/uploadlib.php @@ -582,6 +582,8 @@ function clam_handle_infected_file($file, $userid=0, $basiconly=false) { * @return boolean */ function clam_replace_infected_file($file) { + global $CFG; + $newcontents = get_string('virusplaceholder'); if (!$f = fopen($file, 'w')) { return false; @@ -589,6 +591,7 @@ function clam_replace_infected_file($file) { if (!fwrite($f, $newcontents)) { return false; } + @chmod($file, $CFG->filepermissions); return true; } diff --git a/mod/scorm/lib.php b/mod/scorm/lib.php index fe26e5420ae..94e81038bbe 100644 --- a/mod/scorm/lib.php +++ b/mod/scorm/lib.php @@ -1014,6 +1014,7 @@ function scorm_debug_log_filename($type, $scoid) { * @param integer $scoid - scoid of object this log entry is for. */ function scorm_debug_log_write($type, $text, $scoid) { + global $CFG; $debugenablelog = get_config('scorm', 'allowapidebug'); if (!$debugenablelog || empty($text)) { @@ -1022,6 +1023,7 @@ function scorm_debug_log_write($type, $text, $scoid) { if (make_temp_directory('scormlogs/')) { $logfile = scorm_debug_log_filename($type, $scoid); @file_put_contents($logfile, date('Y/m/d H:i:s O')." DEBUG $text\r\n", FILE_APPEND); + @chmod($logfile, $CFG->filepermissions); } } diff --git a/repository/googledocs/lib.php b/repository/googledocs/lib.php index 8ef735d36b2..0380fdc9a14 100644 --- a/repository/googledocs/lib.php +++ b/repository/googledocs/lib.php @@ -414,12 +414,15 @@ class repository_googledocs extends repository { * @return string JSON encoded array of information about the file. */ public function get_file($reference, $filename = '') { + global $CFG; + $request = new Google_HttpRequest($reference); $httpRequest = Google_Client::$io->authenticatedRequest($request); if ($httpRequest->getResponseHttpCode() == 200) { $path = $this->prepare_file($filename); $content = $httpRequest->getResponseBody(); if (file_put_contents($path, $content) !== false) { + @chmod($path, $CFG->filepermissions); return array( 'path' => $path, 'url' => $reference