Checking for SMH: Creating folder returns false negative

[fbender]

I'm running a Debian server with PHP 5.2.6 (yes, it's old, but it's a Debian-patched version) under Apache with suPHP. Apache runs as www-data, the PHP scripts run as the specific user (in my testing case: rabp).

Result from "Do I need to use the Safe Mode Hack?" in Contao Check 4.1:

1. safe_mode NOT enabled (GREEN).
2. Test folder could be created but does not have the correct owner (RED). Should be: root, is: rabp.
3. Test file could be created (GREEN). Owner is: rabp.

I never had a problem with Contao running without the Safe Mode Hack and the former Contao Check also returned ALL GREEN. Thus, the new Contao Check most likely returns a false negative. The code testing the folder permissions must have changed compared to the old Contao Check. Why is the file checked for a different owner than the folder?

[leofeyer]

Thus, the new Contao Check most likely returns a false negative

No, it does not. The owner of the folder should be the same user the PHP process runs as (rabp in your case).

[fbender]

I'm sorry if I wasn't clear enough: PHP runs as rabp, the file created is owned by rabp, the folder created is owned by rabp BUT Contao Check (falsly) wants the folder to be owned by root (however, not the file).

But this bug has been fixed by commit 10026cf as well. I did not see any more notices after fixing the one entry mentioned in Bug #34 thus I did not check for further uses of __DIR__ – I guess those other uses were responsible for returning root as the desired owner: fileowner() probably returned false, this was casted to 0 thus root was returned by posix_getpwuid().