Scheduled rate-limit preview window: between 15:00 and 19:00 UTC on 7 October, the new limits will be briefly active so you can see how your workloads are affected. They are live only during this window, and apply permanently from 19 October. Learn more.

Commit 314d9ed2 authored Dec 14, 2019 by Chris Graham

Security fix for MANTIS-4008 (Backups should be given reduced privileges)

parent a520875c

config_editor.php

+1 −0

Changes for config_editor.php: 1 added line, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -434,6 +434,7 @@ function do_set()
		$config_file = '_config.php';
		$backup_path = $FILE_BASE . '/exports/file_backups/' . $config_file . '.' . strval(time()) . '_' . strval(mt_rand(0, mt_getrandmax()));
		$copied_ok = @copy($FILE_BASE . '/' . $config_file, $backup_path);
		@chmod($backup_path, 0600);
		if ($copied_ok !== false) {
		co_sync_file($backup_path);
		}

sources/backup.php

+2 −2

Changes for sources/backup.php: 2 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -262,7 +262,7 @@ function make_backup($file, $b_type = 'full', $max_size = 100) // This is called

		rename($backup_file_tmp_path, $backup_file_path);

		fix_permissions($backup_file_path);
		fix_permissions($backup_file_path, 0600);

		// Compress...

		@@ -287,7 +287,7 @@ function make_backup($file, $b_type = 'full', $max_size = 100) // This is called

		rename($compressed_file_tmp_path, $compressed_file_path);

		fix_permissions($compressed_file_path);
		fix_permissions($compressed_file_path, 0600);
		}

		// Finish logging...

sources/global3.php

+4 −0

Changes for sources/global3.php: 4 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -217,7 +217,11 @@ function fix_permissions($path, $perms = null)

		// If the file user is different to the FTP user, we need to make it world writeable
		if ((!is_suexec_like()) \|\| (cms_srv('REQUEST_METHOD') == '')) {
		if ($perms == 0600) {
		@chmod($path, 0666);
		} else {
		@chmod($path, $perms);
		}
		} else { // Otherwise we do not
		if ($perms == 0666) {
		@chmod($path, 0644);