From ef7dd02cc7df9d003d7d226cbc0aee44d6bcc9b5 Mon Sep 17 00:00:00 2001 From: Ruslan Kabalin Date: Mon, 15 Apr 2013 10:30:36 +0100 Subject: [PATCH] MDL-34939: Fix clamdscan permissions-related issues Use --fdpass parameter that passes the file descriptor permissions to clamd, which allows to scan given file irrespective of directory and file permissions. Changing file permissions is not required. --- repository/lib.php | 14 ++++++++++---- repository/upload/lib.php | 5 ----- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/repository/lib.php b/repository/lib.php index 65619ce3520..546ea83c055 100644 --- a/repository/lib.php +++ b/repository/lib.php @@ -1143,11 +1143,17 @@ abstract class repository { return; } - // do NOT mess with permissions here, the calling party is responsible for making - // sure the scanner engine can access the files! - + $clamparam = ' --stdout '; + // If we are dealing with clamdscan, clamd is likely run as a different user + // that might not have permissions to access your file. + // To make clamdscan work, we use --fdpass parameter that passes the file + // descriptor permissions to clamd, which allows it to scan given file + // irrespective of directory and file permissions. + if (basename($CFG->pathtoclam) == 'clamdscan') { + $clamparam .= '--fdpass '; + } // execute test - $cmd = escapeshellcmd($CFG->pathtoclam).' --stdout '.escapeshellarg($thefile); + $cmd = escapeshellcmd($CFG->pathtoclam).$clamparam.escapeshellarg($thefile); exec($cmd, $output, $return); if ($return == 0) { diff --git a/repository/upload/lib.php b/repository/upload/lib.php index 1cfcf289da2..8a9c3651c48 100644 --- a/repository/upload/lib.php +++ b/repository/upload/lib.php @@ -141,12 +141,7 @@ class repository_upload extends repository { } } - // scan the files, throws exception and deletes if virus found - // this is tricky because clamdscan daemon might not be able to access the files - $permissions = fileperms($_FILES[$elname]['tmp_name']); - @chmod($_FILES[$elname]['tmp_name'], $CFG->filepermissions); self::antivir_scan_file($_FILES[$elname]['tmp_name'], $_FILES[$elname]['name'], true); - @chmod($_FILES[$elname]['tmp_name'], $permissions); // {@link repository::build_source_field()} $sourcefield = $this->get_file_source_info($_FILES[$elname]['name']);