default folder permissions module install

[smarterweb]

In my opinion it's considered an unsafe practice to have the default permissions of folders set to 0777 upon install of new modules. I can see in file controllers\admin\AdminModulesController.php line 1222, 1225, 1252 and 1255 that the default chmod is set to 0777. Shouldn't this rather default to 0755?

[smarterweb]

not sure why you want to use umask. Why not just set the permissions with chmod to 0755?

From the php manual comments: Whenever reasonable, default to shut and open as needed instead of default to open and shut as needed. The above still has a race condition, but the race condition will deny appropriate access instead of granting inappropriate access.

Nut you might have good reasons, not sure...

[smarterweb]

@mdekker ok, I see, well there's your good reason. keep up the good work!

[smarterweb]

@mdekker sorry to dig this up again, but we still have the issue of 777 folder permission with every single module install. I added your <?php if (!defined('TBUMASK')) { define('TBUMASK', 0022); } as a custom defines file, but it's not working on new module installs.

However when I change the file controllers\admin\AdminModulesController.php line 1221, 1224, 1251 and 1254 from 0777 to 0755 I no longer have this problem

can you please again as it's rather annoying having to chmod after each and every module install. Many thanks

[Traumflug]

Let's track this on Github: https://github.com/thirtybees/thirtybees/issues/522

[30knees]

Is there anything we should manually change with installed modules from a security perspective?

[Traumflug]

@smarterweb, some quick research found that PHP handles file modes differently on Windows vs. a Unix-type OS.

Which kind of OS is your server running?

[smarterweb]

we're using Centos 6 with cloudlinux