romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 07:03:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

fopen: create new file using old file's mode

Browse source 
Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing
the old mode could otherwise end up creating a file that was no longer
readable by the original owner after save.

Reported-by: Loïc Yhuel
Fixes #12299
Closes #12395
This commit is contained in:
Daniel Stenberg 2023-11-23 15:52:57 +01:00
parent 242e6d019f
commit 03cb1ff4d6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 1 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/curl_config.h.cmake
View file

@ -177,9 +177,6 @@
/* Define to 1 if you have _Atomic support. */
#cmakedefine HAVE_ATOMIC 1
/* Define to 1 if you have the `fchmod' function. */
#cmakedefine HAVE_FCHMOD 1
/* Define to 1 if you have the `fnmatch' function. */
#cmakedefine HAVE_FNMATCH 1

14
lib/fopen.c
View file

@ -129,22 +129,10 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
}
result = CURLE_WRITE_ERROR;
fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600);
fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600|sb.st_mode);
if(fd == -1)
goto fail;
#ifdef HAVE_FCHMOD
{
struct_stat nsb;
if((fstat(fd, &nsb) != -1) &&
(nsb.st_uid == sb.st_uid) && (nsb.st_gid == sb.st_gid)) {
/* if the user and group are the same, clone the original mode */
if(fchmod(fd, (mode_t)sb.st_mode) == -1)
goto fail;
}
}
#endif
*fh = fdopen(fd, FOPEN_WRITETEXT);
if(!*fh)
goto fail;