From 342b624d27fe1ea9ef0f4995d6e19ca6738c3a6b Mon Sep 17 00:00:00 2001
From: "mkanat%bugzilla.org"
 <mkanat%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 24 Jun 2010 17:10:19 +0000
Subject: [PATCH] Bug 561797: (CVE-2010-0180) [SECURITY] checksetup.pl with
 $use_suexec=1 sets localconfig as world readable r=timello, a=mkanat

git-svn-id: svn://10.0.0.236/branches/BUGZILLA-3_6-BRANCH@260560 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev                  |  2 +-
 .../bugzilla/Bugzilla/Install/Filesystem.pm        | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 644b516d0d2..07cf2a17c24 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-7110
\ No newline at end of file
+7111
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/Install/Filesystem.pm b/mozilla/webtools/bugzilla/Bugzilla/Install/Filesystem.pm
index 4dc8a484d24..789f193e566 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/Install/Filesystem.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/Install/Filesystem.pm
@@ -75,6 +75,13 @@ sub FILESYSTEM {
     my $skinsdir      = bz_locations()->{'skinsdir'};
     my $localconfig   = bz_locations()->{'localconfig'};
 
+    # We want to set the permissions the same for all localconfig files
+    # across all PROJECTs, so we do something special with $localconfig,
+    # lower down in the permissions section.
+    if ($ENV{PROJECT}) {
+        $localconfig =~ s/\.\Q$ENV{PROJECT}\E$//;
+    }
+
     my $ws_group      = Bugzilla->localconfig->{'webservergroup'};
     my $use_suexec    = Bugzilla->localconfig->{'use_suexec'};
 
@@ -92,6 +99,9 @@ sub FILESYSTEM {
     # Writeable by the web server.
     my $ws_writeable = $ws_group ? 0660 : 0666;
 
+    # Script-readable files that should not be world-readable under suexec.
+    my $script_readable = $use_suexec ? 0640 : $ws_readable;
+
     # DIRECTORIES
     # Readable by the web server.
     my $ws_dir_readable  = ($ws_group && !$use_suexec) ? 0750 : 0755;
@@ -129,6 +139,10 @@ sub FILESYSTEM {
         'migrate.pl'      => { perms => $owner_executable },
         'install-module.pl' => { perms => $owner_executable },
 
+        # Set the permissions for localconfig the same across all
+        # PROJECTs.
+        $localconfig       => { perms => $script_readable },
+        "$localconfig.*"   => { perms => $script_readable },
         "$localconfig.old" => { perms => $owner_readable },
 
         'contrib/README'       => { perms => $owner_readable },