Merge branch 'MDL-34939-master' of https://github.com/lucisgit/moodle

repository/lib.php

@@ -1206,11 +1206,17 @@ abstract class repository implements cacheable_object {
             return;
         }
 
-        // do NOT mess with permissions here, the calling party is responsible for making
-        // sure the scanner engine can access the files!
-
+        $clamparam = ' --stdout ';
+        // If we are dealing with clamdscan, clamd is likely run as a different user
+        // that might not have permissions to access your file.
+        // To make clamdscan work, we use --fdpass parameter that passes the file
+        // descriptor permissions to clamd, which allows it to scan given file
+        // irrespective of directory and file permissions.
+        if (basename($CFG->pathtoclam) == 'clamdscan') {
+            $clamparam .= '--fdpass ';
+        }
         // execute test
-        $cmd = escapeshellcmd($CFG->pathtoclam).' --stdout '.escapeshellarg($thefile);
+        $cmd = escapeshellcmd($CFG->pathtoclam).$clamparam.escapeshellarg($thefile);
         exec($cmd, $output, $return);
 
         if ($return == 0) {

repository/upload/lib.php

@@ -141,12 +141,7 @@ class repository_upload extends repository {
             }
         }
 
-        // scan the files, throws exception and deletes if virus found
-        // this is tricky because clamdscan daemon might not be able to access the files
-        $permissions = fileperms($_FILES[$elname]['tmp_name']);
-        @chmod($_FILES[$elname]['tmp_name'], $CFG->filepermissions);
         self::antivir_scan_file($_FILES[$elname]['tmp_name'], $_FILES[$elname]['name'], true);
-        @chmod($_FILES[$elname]['tmp_name'], $permissions);
 
         // {@link repository::build_source_field()}
         $sourcefield = $this->get_file_source_info($_FILES[$elname]['name']);