13366: Extending a theme creates world writable directories

This bug affects 1 person(s).

ID	Project	Category	View Status	Date Submitted	Last Update

13366	Bug reports	Theme editor	public	2018-02-16 00:07	2018-03-09 16:36

Reporter	RichieB	Assigned To	~~LouisGac~~
Priority	none	Severity	minor
Status	closed	Resolution	fixed
Product Version	3.1.x

Summary	13366: Extending a theme creates world writable directories
Description	When extending a theme a new directory tree upload/themes/survey/<name> get's created. All subdirectories below this new path are world writable which is bad security practice.
Steps To Reproduce	Extend a theme, name the new theme footer Observe world writable directies inside upload/themes/survey/foobar
Tags	No tags attached.

Bug heat	6
Complete LimeSurvey version number (& build)	3.2.0+180206
I will donate to the project if issue is resolved	No
Browser
Database type & version	mysql 5.7.21-0ubuntu0.16.04.1
Server OS (if known)	Ubuntu 16.04.1
Webserver software & version (if known)	apache 2.4.18-2ubuntu3.5
PHP Version	7.0.22-0ubuntu0.16.04.1

User List	There are no users monitoring this issue.

~~LouisGac~~ 2018-02-16 10:24 developer ~46544	It's rather a server configuration problem. Directories are created by web user (www-data in ubuntu), so they should be writable only by the web-user.

RichieB 2018-02-16 15:13 reporter ~46551	No, it is set to mode 0777 explicitly by several places in the php code like: https://github.com/LimeSurvey/LimeSurvey/blob/master/framework/utils/CFileHelper.php#L359 https://github.com/LimeSurvey/LimeSurvey/blob/master/framework/cli/commands/WebAppCommand.php#L105

~~LouisGac~~ 2018-02-16 15:20 developer ~46552	ok... thank you very much

~~LouisGac~~ 2018-03-05 18:33 developer ~46910	Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=26667

c_schmitz 2018-03-09 16:36 administrator ~46991	Version 3.5.0 180309 released

Date Modified	Username	Field	Change
2018-02-16 00:07	RichieB	New Issue
2018-02-16 10:24	~~LouisGac~~	Note Added: 46544
2018-02-16 15:13	RichieB	Note Added: 46551
2018-02-16 15:20	~~LouisGac~~	Note Added: 46552
2018-03-05 11:41	~~LouisGac~~	Sticky Issue	No => Yes
2018-03-05 18:33	~~LouisGac~~	Changeset attached	=> LimeSurvey master a53d5b14
2018-03-05 18:33	~~LouisGac~~	Note Added: 46910
2018-03-05 18:33	~~LouisGac~~	Assigned To	=> LouisGac
2018-03-05 18:33	~~LouisGac~~	Resolution	open => fixed
2018-03-05 18:37	~~LouisGac~~	Sticky Issue	Yes => No
2018-03-05 18:37	~~LouisGac~~	Status	new => resolved
2018-03-09 16:36	c_schmitz	Note Added: 46991
2018-03-09 16:36	c_schmitz	Status	resolved => closed

LimeSurvey: master a53d5b14 2018-03-05 19:33 ~~LouisGac~~ Details Diff	Fixed issue 13366: Extending a theme creates world writable directories		Affected Issues 13366
	mod - application/controllers/admin/themes.php		Diff File