Merge branch 'security/zf2015-07'

Addresses ZF2015-07
zendframework · Sep 15, 2015 · b656b63 · b656b63
2 parents e47212e + e7704a2
commit b656b63
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 11 deletions.
diff --git a/src/Pattern/CaptureCache.php b/src/Pattern/CaptureCache.php
@@ -300,14 +300,14 @@ protected function createDirectoryStructure($pathname)
             // build-in mkdir function is enough
 
             $umask = ($umask !== false) ? umask($umask) : false;
-            $res   = mkdir($pathname, ($perm !== false) ? $perm : 0777, true);
+            $res   = mkdir($pathname, ($perm !== false) ? $perm : 0775, true);
 
             if ($umask !== false) {
                 umask($umask);
             }
 
             if (!$res) {
-                $oct = ($perm === false) ? '777' : decoct($perm);
+                $oct = ($perm === false) ? '775' : decoct($perm);
                 $err = ErrorHandler::stop();
                 throw new Exception\RuntimeException("mkdir('{$pathname}', 0{$oct}, true) failed", 0, $err);
             }
@@ -340,13 +340,13 @@ protected function createDirectoryStructure($pathname)
 
                 // create a single directory, set and reset umask immediately
                 $umask = ($umask !== false) ? umask($umask) : false;
-                $res   = mkdir($path, ($perm === false) ? 0777 : $perm, false);
+                $res   = mkdir($path, ($perm === false) ? 0775 : $perm, false);
                 if ($umask !== false) {
                     umask($umask);
                 }
 
                 if (!$res) {
-                    $oct = ($perm === false) ? '777' : decoct($perm);
+                    $oct = ($perm === false) ? '775' : decoct($perm);
                     ErrorHandler::stop();
                     throw new Exception\RuntimeException(
                         "mkdir('{$path}', 0{$oct}, false) failed"

diff --git a/src/Pattern/PatternOptions.php b/src/Pattern/PatternOptions.php
@@ -375,7 +375,7 @@ public function setUmask($umask)
             }
 
             // normalize
-            $umask = $umask & 0777;
+            $umask = $umask & ~0002;
         }
 
         $this->umask = $umask;

diff --git a/src/Storage/Adapter/Filesystem.php b/src/Storage/Adapter/Filesystem.php
@@ -1405,7 +1405,7 @@ protected function prepareDirectoryStructure($file)
             // build-in mkdir function is enough
 
             $umask = ($umask !== false) ? umask($umask) : false;
-            $res   = mkdir($pathname, ($perm !== false) ? $perm : 0777, true);
+            $res   = mkdir($pathname, ($perm !== false) ? $perm : 0775, true);
 
             if ($umask !== false) {
                 umask($umask);
@@ -1421,7 +1421,7 @@ protected function prepareDirectoryStructure($file)
                     return;
                 }
 
-                $oct = ($perm === false) ? '777' : decoct($perm);
+                $oct = ($perm === false) ? '775' : decoct($perm);
                 throw new Exception\RuntimeException("mkdir('{$pathname}', 0{$oct}, true) failed", 0, $err);
             }
 
@@ -1453,7 +1453,7 @@ protected function prepareDirectoryStructure($file)
 
                 // create a single directory, set and reset umask immediately
                 $umask = ($umask !== false) ? umask($umask) : false;
-                $res   = mkdir($path, ($perm === false) ? 0777 : $perm, false);
+                $res   = mkdir($path, ($perm === false) ? 0775 : $perm, false);
                 if ($umask !== false) {
                     umask($umask);
                 }
@@ -1466,7 +1466,7 @@ protected function prepareDirectoryStructure($file)
                         continue;
                     }
 
-                    $oct = ($perm === false) ? '777' : decoct($perm);
+                    $oct = ($perm === false) ? '775' : decoct($perm);
                     ErrorHandler::stop();
                     throw new Exception\RuntimeException(
                         "mkdir('{$path}', 0{$oct}, false) failed"

diff --git a/src/Storage/Adapter/FilesystemOptions.php b/src/Storage/Adapter/FilesystemOptions.php
@@ -434,7 +434,7 @@ public function setUmask($umask)
             }
 
             // normalize
-            $umask = $umask & 0777;
+            $umask = $umask & ~0002;
         }
 
         if ($this->umask !== $umask) {

diff --git a/test/Storage/Adapter/FilesystemTest.php b/test/Storage/Adapter/FilesystemTest.php
@@ -237,7 +237,7 @@ public function testSetDirLevelInvalidException()
     public function testSetUmask()
     {
         $this->_options->setUmask(023);
-        $this->assertSame(023, $this->_options->getUmask());
+        $this->assertSame(021, $this->_options->getUmask());
 
         $this->_options->setUmask(false);
         $this->assertFalse($this->_options->getUmask());