From ed5c3b391a381d363e1b9070554d11c2b4881e3f Mon Sep 17 00:00:00 2001
From: Max Kanat-Alexander <mkanat@bugzilla.org>
Date: Thu, 24 Jun 2010 17:17:52 -0700
Subject: Bug 457373: Refactor the permissions system in
 Bugzilla::Install::Filesystem to use constants instead of local variables.
 Also, change the permissions so that they are stricter in general, and work
 better under suexec. This also fixes the problem that dependency graphs
 didn't work under suexec, and adds a "web" directory by default to Extensions
 created with extension/create.pl. r=mkanat, a=mkanat (module owner)

---
 showdependencygraph.cgi | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

(limited to 'showdependencygraph.cgi')

diff --git a/showdependencygraph.cgi b/showdependencygraph.cgi
index a036ee0c9..5fadce998 100755
--- a/showdependencygraph.cgi
+++ b/showdependencygraph.cgi
@@ -29,6 +29,7 @@ use File::Temp;
 
 use Bugzilla;
 use Bugzilla::Constants;
+use Bugzilla::Install::Filesystem;
 use Bugzilla::Util;
 use Bugzilla::Error;
 use Bugzilla::Bug;
@@ -114,7 +115,13 @@ if (!defined $cgi->param('id') && $display ne 'doall') {
 
 my ($fh, $filename) = File::Temp::tempfile("XXXXXXXXXX",
                                            SUFFIX => '.dot',
-                                           DIR => $webdotdir);
+                                           DIR => $webdotdir,
+                                           UNLINK => 1);
+
+chmod Bugzilla::Install::Filesystem::CGI_WRITE, $filename
+    or warn install_string('chmod_failed', { path => $filename,
+                                             error => $! });
+
 my $urlbase = Bugzilla->params->{'urlbase'};
 
 print $fh "digraph G {";
@@ -244,8 +251,6 @@ foreach my $k (keys(%seen)) {
 print $fh "}\n";
 close $fh;
 
-chmod 0777, $filename;
-
 my $webdotbase = Bugzilla->params->{'webdotbase'};
 
 if ($webdotbase =~ /^https?:/) {
@@ -263,13 +268,18 @@ if ($webdotbase =~ /^https?:/) {
     my ($pngfh, $pngfilename) = File::Temp::tempfile("XXXXXXXXXX",
                                                      SUFFIX => '.png',
                                                      DIR => $webdotdir);
+
+    chmod Bugzilla::Install::Filesystem::WS_SERVE, $pngfilename
+        or warn install_string('chmod_failed', { path => $pngfilename,
+                                                 error => $! });
+
     binmode $pngfh;
     open(DOT, "\"$webdotbase\" -Tpng $filename|");
     binmode DOT;
     print $pngfh $_ while <DOT>;
     close DOT;
     close $pngfh;
-    
+
     # On Windows $pngfilename will contain \ instead of /
     $pngfilename =~ s|\\|/|g if ON_WINDOWS;
 
@@ -287,12 +297,18 @@ if ($webdotbase =~ /^https?:/) {
     my ($mapfh, $mapfilename) = File::Temp::tempfile("XXXXXXXXXX",
                                                      SUFFIX => '.map',
                                                      DIR => $webdotdir);
+
+    chmod Bugzilla::Install::Filesystem::WS_SERVE, $mapfilename
+        or warn install_string('chmod_failed', { path => $mapfilename,
+                                                 error => $! });
+
     binmode $mapfh;
     open(DOT, "\"$webdotbase\" -Tismap $filename|");
     binmode DOT;
     print $mapfh $_ while <DOT>;
     close DOT;
     close $mapfh;
+
     $vars->{'image_map'} = CreateImagemap($mapfilename);
 }
 
-- 
cgit v1.2.3-24-g4f1b