285137 - checksetup.pl should fixPerms the Bugzilla directory

Status: RESOLVED FIXED

(Bugzilla :: Installation & Upgrading, defect, P3)

Description

[Marc Schumann [:Wurblzap]]

I'm talking about the directory Bugzilla is installed in, not the Bugzilla
subdirectory of it.

I think checksetup.pl should give the right permissions to the Bugzilla
directory so that it is neither too open (rwxrwxrwx -- giving full access to
local users) nor too protected (rwx------ -- possibly giving no access to the
web server).

Comment 1

[Dave Miller [:justdave]]

This makes sense.  It's a FAQ, even. :)

Comment 2

[Max Kanat-Alexander]

Yeah, that does make sense. There's a larger chance that that will fail to
actually work (because the /var/html/www directory perms might not let me change
the Bugzilla directory perms), but it's still a good thing to attempt to do.

I'd guess that the perms should be... 750? Or if we don't have a good
webservergroup, then 755.

Comment 3

[Myk Melez [:myk] [@mykmelez]]

"If it's not a regression from 2.18 and it's not a critical problem with
something that's already landed, let's push it off." - Dave

Comment 4

[Marc Schumann [:Wurblzap]]

This has Myk's [wanted for 2.20] stamp on it -- requesting blocking2.22.

Comment 5

[Dave Miller [:justdave]]

I'll take this for both 2.20 and 2.22 if someone does it (before we branch for 2.22), but I won't hold the release for it.

Comment 6

[Mike White]

Attachment: Fix permissions on "."

Call fixPerms on "." during the rest of the permissions checking.

Comment 7

[Frédéric Buclin]

Comment on attachment 203892 [details] [diff] [review]
Fix permissions on "."

>+        fixPerms('.', $<, $webservergid, 027, 1);

If we pass '.' to fixPerms(), then the perms for .htaccess will be automatically set, right? Then we could remove the line fixing .htaccess separately.

Comment 8

[Max Kanat-Alexander]

(In reply to comment #7)
> If we pass '.' to fixPerms(), then the perms for .htaccess will be
> automatically set, right?

  No, I don't think so... why would that happen?

Comment 9

[Marc Schumann [:Wurblzap]]

Comment on attachment 203892 [details] [diff] [review]
Fix permissions on "."

You're handing 1 as do_dirs parameter to fixPerms, which makes it steamroll over all permissions that have been finely tuned in the preceding lines. Don't do that :)

I think that the do_dir parameter should be 0. (Comment 7 doesn't apply anymore then, so the .htaccess fixPerms call needs to stay.)

Comment 10

[Marc Schumann [:Wurblzap]]

Mike, are you willing to take another stab at this?

Comment 11

[Mike White]

Unfortunately not in the short term, sorry.

Comment 12

[Frédéric Buclin]

Only security and dataloss fixes will be accepted on the 2.20 branch.

Comment 13

[Max Kanat-Alexander]

It's really easy to fix this while I'm writing bug 346552, so I'm doing it there, for the tip.

Comment 14

[Marc Schumann [:Wurblzap]]

I for one wouldn't mind setting this bug's target milestone to 2.24 and marking it FIXED.

Comment 15

[Max Kanat-Alexander]

Okay, sounds good to me. :-) Fixed by blocker.