Improve file access rights in webgui

webgui/documents.php

@@ -153,6 +153,7 @@ switch ($submit = form_get_action()) {
         $id = db_exec_insert('document', $p);
         $file_techname = sprintf('%s/%s-%06d.%s', $g_doc_basepath, $prefix, $id, $file_ext);
         move_uploaded_file($file_tmp, $file_techname);
+        chmod($file_techname, 0640);
         $action = ACT_VIEW;
         break;
 

webgui/equipment.php

@@ -202,6 +202,7 @@ switch ($submit = form_get_action()) {
                 $docid = $pdo->lastInsertId();
                 $file_techname = file_get_docname($docid, 'picture', $file_ext);
                 move_uploaded_file($file_tmp, $g_doc_basepath . '/' . $file_techname);
+                chmod($g_doc_basepath . '/' . $file_techname, 0640);
             } else {
                 // A document record definitely exists here, now just 
                 // connect it to the selected equipment

webgui/globals.inc

@@ -56,6 +56,8 @@ $g_scriptname = basename($_SERVER['SCRIPT_NAME']);
 
 require 'config.inc';
 
+umask(0027); // no rights for world!
+
 // Localization
 
 $lang = get_browser_lang(['de', 'en']);