curl/curl
1
1
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-09-11 06:32:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fopen: create new file using old file's mode

Browse Source 
Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing
the old mode could otherwise end up creating a file that was no longer
readable by the original owner after save.

Reported-by: Loïc Yhuel
Fixes #12299
Closes #12395
This commit is contained in:
Daniel Stenberg 2023-11-23 15:52:57 +01:00
parent 242e6d019f
commit 03cb1ff4d6
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
4 changed files with 1 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CMakeLists.txt
View File

@ -1185,7 +1185,6 @@ elseif(HAVE_LIBSOCKET)
set(CMAKE_REQUIRED_LIBRARIES socket) set(CMAKE_REQUIRED_LIBRARIES socket)
endif() endif()
check_symbol_exists(fchmod "${CURL_INCLUDES}" HAVE_FCHMOD)
check_symbol_exists(fnmatch "${CURL_INCLUDES};fnmatch.h" HAVE_FNMATCH) check_symbol_exists(fnmatch "${CURL_INCLUDES};fnmatch.h" HAVE_FNMATCH)
check_symbol_exists(basename "${CURL_INCLUDES};string.h" HAVE_BASENAME) check_symbol_exists(basename "${CURL_INCLUDES};string.h" HAVE_BASENAME)
check_symbol_exists(socket "${CURL_INCLUDES}" HAVE_SOCKET) check_symbol_exists(socket "${CURL_INCLUDES}" HAVE_SOCKET)

1
configure.ac
View File

@ -3581,7 +3581,6 @@ AC_CHECK_DECLS([getpwuid_r], [], [AC_DEFINE(HAVE_DECL_GETPWUID_R_MISSING, 1, "Se
AC_CHECK_FUNCS([\ AC_CHECK_FUNCS([\
_fseeki64 \ _fseeki64 \
arc4random \ arc4random \
fchmod \
fnmatch \ fnmatch \
fseeko \ fseeko \
geteuid \ geteuid \

3
lib/curl_config.h.cmake
View File

@ -177,9 +177,6 @@
/* Define to 1 if you have _Atomic support. */ /* Define to 1 if you have _Atomic support. */
#cmakedefine HAVE_ATOMIC 1 #cmakedefine HAVE_ATOMIC 1
/* Define to 1 if you have the `fchmod' function. */
#cmakedefine HAVE_FCHMOD 1
/* Define to 1 if you have the `fnmatch' function. */ /* Define to 1 if you have the `fnmatch' function. */
#cmakedefine HAVE_FNMATCH 1 #cmakedefine HAVE_FNMATCH 1

14
lib/fopen.c
View File

@ -129,22 +129,10 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
} }
result = CURLE_WRITE_ERROR; result = CURLE_WRITE_ERROR;
fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600); fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600|sb.st_mode);
if(fd == -1) if(fd == -1)
goto fail; goto fail;
#ifdef HAVE_FCHMOD
{
struct_stat nsb;
if((fstat(fd, &nsb) != -1) &&
(nsb.st_uid == sb.st_uid) && (nsb.st_gid == sb.st_gid)) {
/* if the user and group are the same, clone the original mode */
if(fchmod(fd, (mode_t)sb.st_mode) == -1)
goto fail;
}
}
#endif
*fh = fdopen(fd, FOPEN_WRITETEXT); *fh = fdopen(fd, FOPEN_WRITETEXT);
if(!*fh) if(!*fh)
goto fail; goto fail;