[ php-blog-Bugs-1931794 ] Post via XML-RPC has issues with file perms & base64 uploads

Bugs item #1931794, was opened at 2008-04-01 18:38
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1931794&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Plugins
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Post via XML-RPC has issues with file perms & base64 uploads

Initial Comment:
1. The plugin has code for creating directories and files, but, whilst the rest of serendipity sets 'correct' permissions on such things when it creates them, the plugin does not. This can result in files and directories being created with permissions that prevent them from being used. My fix for this was to add chmod calls in two locations:

    if (!is_dir(dirname($full))) {
        @mkdir(dirname($full));
        @chmod(dirname($full), 0701);
    }                  

...

    $fp = fopen($full, 'w');
    fwrite($fp, $struct['bits']);
    fclose($fp);
    @chmod($full, 0604);

Preferred default permissions may vary from mine. :)

2. Whilst detecting wether or not the data sent was base64 encoded was added, it relies on PHP actually doing the right thing. It does not and, as such, the result of the function call is 'true', $decode gets filled with corrupted data and the sky falls. This happens most frequently on GIF files as they begin with a bit of plain text, which seems to signal to PHP that all is right with the input data and that it should merrily go forth and decode no matter what. JPEGs, which don't have a bit of plain text at the beginning, don't cause this problem to pop up.

My fix for this is below. Hopefully it is right but I'm not 100% sure how the data is meant to look. I got the regex off the base64_decode decode and am hoping the poster of that is accurate in his helpfulness. :)

    if (preg_match('#^[a-zA-Z0-9/+]*={0,2}$#', $struct['bits'])) {
        if($decoded = base64_decode ($struct['bits'], true)) {
            $struct['bits'] = $decoded;
        }
    }

I used two ifs because, well, it made things look neat and tidy.

Hope all this is helpful.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1931794&group_id=75065

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace