[ php-blog-Bugs-1931794 ] Post via XML-RPC has issues with file perms & base64 uploads

Bugs item #1931794, was opened at 2008-04-02 01:38
Message generated for change (Comment added) made by garvinhicking
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1931794&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Plugins
Group: None
>Status: Pending
>Resolution: Fixed
>Priority: 1
Private: No
Submitted By: Nobody/Anonymous (nobody)
>Assigned to: Garvin Hicking (garvinhicking)
Summary: Post via XML-RPC has issues with file perms & base64 uploads

Initial Comment:
1. The plugin has code for creating directories and files, but, whilst the rest of serendipity sets 'correct' permissions on such things when it creates them, the plugin does not. This can result in files and directories being created with permissions that prevent them from being used. My fix for this was to add chmod calls in two locations:

    if (!is_dir(dirname($full))) {
        @mkdir(dirname($full));
        @chmod(dirname($full), 0701);
    }                  

...

    $fp = fopen($full, 'w');
    fwrite($fp, $struct['bits']);
    fclose($fp);
    @chmod($full, 0604);

Preferred default permissions may vary from mine. :)

2. Whilst detecting wether or not the data sent was base64 encoded was added, it relies on PHP actually doing the right thing. It does not and, as such, the result of the function call is 'true', $decode gets filled with corrupted data and the sky falls. This happens most frequently on GIF files as they begin with a bit of plain text, which seems to signal to PHP that all is right with the input data and that it should merrily go forth and decode no matter what. JPEGs, which don't have a bit of plain text at the beginning, don't cause this problem to pop up.

My fix for this is below. Hopefully it is right but I'm not 100% sure how the data is meant to look. I got the regex off the base64_decode decode and am hoping the poster of that is accurate in his helpfulness. :)

    if (preg_match('#^[a-zA-Z0-9/+]*={0,2}$#', $struct['bits'])) {
        if($decoded = base64_decode ($struct['bits'], true)) {
            $struct['bits'] = $decoded;
        }
    }

I used two ifs because, well, it made things look neat and tidy.

Hope all this is helpful.

----------------------------------------------------------------------

>Comment By: Garvin Hicking (garvinhicking)
Date: 2008-04-02 09:05

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Thanks for contributing. :)

Which client are you using that posts binary data instead of base64
encoded? Regarding the API, I was lead to belief this was invalid?

I just committed your patch for the preg-detection. I also committed your
chmod patch, by using the default chmod's in s9y (755 & 664).

Thanks & Regards,
Garvin

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2008-04-02 03:53

Message:
Logged In: NO 

I forgot to say that the true flag, being 5.2.0+ is probably not what
Serendipity should use unless one wants to up the min req version of PHP.

All is not lost, though, for it is wholly useless and the function will
still return true on bad data.

Joy!

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1931794&group_id=75065

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace