Bug 457373: Refactor the permissions system in Bugzilla::Install::Filesystem

to use constants instead of local variables. Also, change the permissions
so that they are stricter in general, and work better under suexec.
This also fixes the problem that dependency graphs didn't work under
suexec, and adds a "web" directory by default to Extensions created with
extension/create.pl.
r=mkanat, a=mkanat (module owner)

1 files changed, 20 insertions, 4 deletions

diff --git a/showdependencygraph.cgi b/showdependencygraph.cgi
index a036ee0c9..5fadce998 100755
--- a/showdependencygraph.cgi
+++ b/showdependencygraph.cgi
@@ -29,6 +29,7 @@ use File::Temp;
 
 use Bugzilla;
 use Bugzilla::Constants;
+use Bugzilla::Install::Filesystem;
 use Bugzilla::Util;
 use Bugzilla::Error;
 use Bugzilla::Bug;
@@ -114,7 +115,13 @@ if (!defined $cgi->param('id') && $display ne 'doall') {
 
 my ($fh, $filename) = File::Temp::tempfile("XXXXXXXXXX",
                                            SUFFIX => '.dot',
-                                           DIR => $webdotdir);
+                                           DIR => $webdotdir,
+                                           UNLINK => 1);
+
+chmod Bugzilla::Install::Filesystem::CGI_WRITE, $filename
+    or warn install_string('chmod_failed', { path => $filename,
+                                             error => $! });
+
 my $urlbase = Bugzilla->params->{'urlbase'};
 
 print $fh "digraph G {";
@@ -244,8 +251,6 @@ foreach my $k (keys(%seen)) {
 print $fh "}\n";
 close $fh;
 
-chmod 0777, $filename;
-
 my $webdotbase = Bugzilla->params->{'webdotbase'};
 
 if ($webdotbase =~ /^https?:/) {
@@ -263,13 +268,18 @@ if ($webdotbase =~ /^https?:/) {
     my ($pngfh, $pngfilename) = File::Temp::tempfile("XXXXXXXXXX",
                                                      SUFFIX => '.png',
                                                      DIR => $webdotdir);
+
+    chmod Bugzilla::Install::Filesystem::WS_SERVE, $pngfilename
+        or warn install_string('chmod_failed', { path => $pngfilename,
+                                                 error => $! });
+
     binmode $pngfh;
     open(DOT, "\"$webdotbase\" -Tpng $filename|");
     binmode DOT;
     print $pngfh $_ while <DOT>;
     close DOT;
     close $pngfh;
-    
+
     # On Windows $pngfilename will contain \ instead of /
     $pngfilename =~ s|\\|/|g if ON_WINDOWS;
 
@@ -287,12 +297,18 @@ if ($webdotbase =~ /^https?:/) {
     my ($mapfh, $mapfilename) = File::Temp::tempfile("XXXXXXXXXX",
                                                      SUFFIX => '.map',
                                                      DIR => $webdotdir);
+
+    chmod Bugzilla::Install::Filesystem::WS_SERVE, $mapfilename
+        or warn install_string('chmod_failed', { path => $mapfilename,
+                                                 error => $! });
+
     binmode $mapfh;
     open(DOT, "\"$webdotbase\" -Tismap $filename|");
     binmode DOT;
     print $mapfh $_ while <DOT>;
     close DOT;
     close $mapfh;
+
     $vars->{'image_map'} = CreateImagemap($mapfilename);
 }