Default upload permissions

[Claude Paroz]

Hi all,

https://code.djangoproject.com/ticket/28540 explains that unless
FILE_UPLOAD_PERMISSION is set (not set by default), uploaded file
permissions are often a mix of 0o600 and 0o644 (or another value
depending of the default umask), based on the upload method (memory or
temporary file) which itself vary depending on the file size.

My opinion is like the reporter's that those permissions should not vary
depending on the used upload method, that's why I suggested the PR
(probably not the cleanest one!):
https://github.com/django/django/pull/10116

Please read the conversation and tell us if you have anything to add
that could help make a decision. Thanks.

Claude
--
www.2xlibre.net

[Carlton Gibson]

Hi all,

This has come up again. So proposal below.

https://code.djangoproject.com/ticket/30004 "Document TemporaryUploadedFile
potential permission issues"

Issue is that, with the default settings, you get 0o644 permissions for
"small" files and 0o600 permissions for "big" ones.
(Depending on which upload handler is used.)

History:

* Claude and I discussed this a bit.
* We are agreed the inconsistent default isn't great.
* We noted just setting FILE_UPLOAD_PERMISSION solves this.
* Given FILE_UPLOAD_PERMISSION = None, Claude suggested a patch which would
"guess" the permissions to use from the process umask.
* I didn't like this:
* too clever, and ultimately not our business.
* Would work for default settings but get in the way once you started
using the related file upload settings. (And so would need an opt-out.)
* In the end we just added a note to the deployment checklist.

This wasn't good enough. (Clearly.)

*Proposal*: we should change the default for FILE_UPLOAD_PERMISSION to
0o644 (or maybe 0o664), and document that as a backward incompatible
change. This would be correct for almost all users. If you're deliberately
leveraging `FILE_UPLOAD_PERMISSION = None` it's an easy switch back to the
current behaviour.

Can I ask you to comment? Thanks.

Kind Regards,

Carlton

[René Fleschenberg]

Hi,

Post by Carlton Gibson
*Proposal*: we should change the default for FILE_UPLOAD_PERMISSION to
0o644 (or maybe 0o664), and document that as a backward incompatible
change. This would be correct for almost all users.  If you're
deliberately leveraging `FILE_UPLOAD_PERMISSION = None` it's an easy
switch back to the current behaviour.

As someone who wasted a couple of hours because of the current behavior,
I am very much in favor of this.

The second-best solution in my opinion would be to have ``manage.py
startproject`` explicitly write the setting, either as 0o644 or as 0o600.
--
René Fleschenberg