Bug 70775

Description of Problem:

I've a php script which uploads files.  These files arrive on the
server (after move_uploaded_file()) with ugo execute permission set.

This can't be good.

Version-Release number of selected component (if applicable):
php-4.0.6-15
apache-1.3.22-6

How Reproducible:

Always.

Steps to Reproduce:

Upload file with php, save with move_uploaded_file.


Expected Results:

I'd expect u=rw,g=rw,o=r permissions (group rw allows "collaboration"
between webserver and others.)

Additional Information:

Am using the default umask in the apache config file. (i.e. umask
never specified.)

My script does contain the code:
// Make the temp directory.
$mask = umask(05002);    // Turn off setuid, sticky bit, and 'other' write
mkdir($temppath, 02774); // Allow anybody to read but not decend
umask($mask);

Later, the uploaded file is moved into $temppath with move_uploaded_file().
This shouldn't matter, but.... (Other files created with fopen, fwrite, fclose
are not executable.)

See also?: Bug#:41229

What is the default upload directory (/etc/php.ini says it's "the system
default") so I can add an appropriate umask to the apache configuration file?
Maybe the default apache umask should be && 0111?

P.S.  It seems a little uncivil to be reporting security problems in
what amounts to a public forum. Is there another way?  (I assigned priority
"low" as it takes another exploit to take advantage of this behavior.)