YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Proper 'if' cases to distinguish between $install_dir vs regular files in $install_dir and $data_dir

Browse source
This commit is contained in:
Alexandre Aubin 2024-06-28 16:45:43 +02:00
parent d9d404a5b2
commit 3608c5678c
1 changed files with 17 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
helpers/helpers.v2.1.d/utils
View file

@ -236,7 +236,7 @@ ynh_app_upgrading_from_version_before_or_equal_to() {
_ynh_apply_default_permissions() { _ynh_apply_default_permissions() {
local target=$1 local target=$1
is_subdir() { is_in_dir() {
# Returns false if child or parent is empty # Returns false if child or parent is empty
child=$(realpath "$1" 2>/dev/null) child=$(realpath "$1" 2>/dev/null)
parent=$(realpath "$2" 2>/dev/null) parent=$(realpath "$2" 2>/dev/null)
@ -245,17 +245,27 @@ _ynh_apply_default_permissions() {
# App files can have files of their own # App files can have files of their own
if ynh_system_user_exists --username="$app"; then if ynh_system_user_exists --username="$app"; then
if is_subdir "$target" "$install_dir" || is_subdir "$target" "$data_dir"; then # If this is a file in $install_dir or $data_dir : it should be owned and read+writable by $app only
chmod -R u=rwX,g=rX,o=X "$target" if [ -f "$target" ] && (([[ -z "${install_dir:-}" ]] is_in_dir "$target" "$install_dir") || ([[ -z "${install_dir:-}" ]] is_in_dir "$target" "$data_dir"))
chown -R "$app:$app" "$target" then
chown "$app:www-data" "$target" chmod 600 "$target"
chown "$app:$app" "$target"
return
fi
# If this is the install dir (so far this is the only way this helper is called with a directory)
if [ "$target" == "$install_dir" ]
then
# Files inside should be owned by $app/www-data with rw-r----- (+x for folders or files that already have +x)
chmod -R u=rwX,g=r-X,o=--- "$target"
# We set the group to www-data because most apps do serve static assets that need to be readable by nginx ...
chown -R "$app:www-data" "$target"
return return
fi fi
fi fi
# Other files are considered system # Other files are considered system
chmod -R 400 "$target" chmod 400 "$target"
chown -R root:root "$target" chown root:root "$target"
} }
int_to_bool() { int_to_bool() {