From 53ea5af9e7dc3969acda50f4c540813ec724ba50 Mon Sep 17 00:00:00 2001
From: Thomas Hooge <thomas@hoogi.de>
Date: Thu, 24 Sep 2026 09:17:41 +0200
Subject: [PATCH] Improve file access rights in webgui

---
 Makefile             | 1 +
 db/minimal.sql       | 1 +
 db/minimal_en.sql    | 1 +
 webgui/documents.php | 1 +
 webgui/equipment.php | 1 +
 webgui/globals.inc   | 2 ++
 6 files changed, 7 insertions(+)

diff --git a/Makefile b/Makefile
index b9f7a9c..9e5027b 100644
--- a/Makefile
+++ b/Makefile
@@ -42,6 +42,7 @@ clean:
 	find . -type d -name "__pycache__" -prune -exec rm -rf {} +
 	find . -type f -name "*.pyc" -delete
 	rm -f locale/program.pot
+	rm -f locale/views.pot
 	rm -f locale/ui.pot
 	rm -f locale/combined.pot
 	rm -f locale/de/LC_MESSAGES/ymsgui.mo
diff --git a/db/minimal.sql b/db/minimal.sql
index 692b5cf..325305b 100644
--- a/db/minimal.sql
+++ b/db/minimal.sql
@@ -30,6 +30,7 @@ INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 4, 'currency symbol e.g. €, $, £, ¥'),
 (-1, 5, 'signalk connection'),
 (-1, 6, 'nmea2000 connection'),
+(-1, 7, 'usb backup device uuid'),
 (-1, 10, 'rows in table'),
 (-1, 20, 'maximum image width'),
 (-1, 21, 'maximum image height'),
diff --git a/db/minimal_en.sql b/db/minimal_en.sql
index 488302f..8cb5296 100644
--- a/db/minimal_en.sql
+++ b/db/minimal_en.sql
@@ -29,6 +29,7 @@ INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 4, 'currency symbol e.g. €, $, £, ¥'),
 (-1, 5, 'signalk connection'),
 (-1, 6, 'nmea2000 connection'),
+(-1, 7, 'usb backup device uuid'),
 (-1, 10, 'rows in table'),
 (-1, 20, 'maximum image width'),
 (-1, 21, 'maximum image height'),
diff --git a/webgui/documents.php b/webgui/documents.php
index 1d25361..5424fcd 100644
--- a/webgui/documents.php
+++ b/webgui/documents.php
@@ -153,6 +153,7 @@ switch ($submit = form_get_action()) {
         $id = db_exec_insert('document', $p);
         $file_techname = sprintf('%s/%s-%06d.%s', $g_doc_basepath, $prefix, $id, $file_ext);
         move_uploaded_file($file_tmp, $file_techname);
+        chmod($file_techname, 0640);
         $action = ACT_VIEW;
         break;
 
diff --git a/webgui/equipment.php b/webgui/equipment.php
index 783b5f6..066e783 100644
--- a/webgui/equipment.php
+++ b/webgui/equipment.php
@@ -202,6 +202,7 @@ switch ($submit = form_get_action()) {
                 $docid = $pdo->lastInsertId();
                 $file_techname = file_get_docname($docid, 'picture', $file_ext);
                 move_uploaded_file($file_tmp, $g_doc_basepath . '/' . $file_techname);
+                chmod($g_doc_basepath . '/' . $file_techname, 0640);
             } else {
                 // A document record definitely exists here, now just 
                 // connect it to the selected equipment
diff --git a/webgui/globals.inc b/webgui/globals.inc
index b7c139a..bbc3584 100644
--- a/webgui/globals.inc
+++ b/webgui/globals.inc
@@ -56,6 +56,8 @@ $g_scriptname = basename($_SERVER['SCRIPT_NAME']);
 
 require 'config.inc';
 
+umask(0027); // no rights for world!
+
 // Localization
 
 $lang = get_browser_lang(['de', 'en']);