Improve file access rights in webgui

Makefile

@@ -42,6 +42,7 @@ clean:
 	find . -type d -name "__pycache__" -prune -exec rm -rf {} +
 	find . -type f -name "*.pyc" -delete
 	rm -f locale/program.pot
+	rm -f locale/views.pot
 	rm -f locale/ui.pot
 	rm -f locale/combined.pot
 	rm -f locale/de/LC_MESSAGES/ymsgui.mo

db/minimal.sql

@@ -30,6 +30,7 @@ INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 4, 'currency symbol e.g. €, $, £, ¥'),
 (-1, 5, 'signalk connection'),
 (-1, 6, 'nmea2000 connection'),
+(-1, 7, 'usb backup device uuid'),
 (-1, 10, 'rows in table'),
 (-1, 20, 'maximum image width'),
 (-1, 21, 'maximum image height'),

db/minimal_en.sql

@@ -29,6 +29,7 @@ INSERT INTO settings (userid, sno, valstr) VALUES
 (-1, 4, 'currency symbol e.g. €, $, £, ¥'),
 (-1, 5, 'signalk connection'),
 (-1, 6, 'nmea2000 connection'),
+(-1, 7, 'usb backup device uuid'),
 (-1, 10, 'rows in table'),
 (-1, 20, 'maximum image width'),
 (-1, 21, 'maximum image height'),

webgui/documents.php

@@ -153,6 +153,7 @@ switch ($submit = form_get_action()) {
         $id = db_exec_insert('document', $p);
         $file_techname = sprintf('%s/%s-%06d.%s', $g_doc_basepath, $prefix, $id, $file_ext);
         move_uploaded_file($file_tmp, $file_techname);
+        chmod($file_techname, 0640);
         $action = ACT_VIEW;
         break;
 

webgui/equipment.php

@@ -202,6 +202,7 @@ switch ($submit = form_get_action()) {
                 $docid = $pdo->lastInsertId();
                 $file_techname = file_get_docname($docid, 'picture', $file_ext);
                 move_uploaded_file($file_tmp, $g_doc_basepath . '/' . $file_techname);
+                chmod($g_doc_basepath . '/' . $file_techname, 0640);
             } else {
                 // A document record definitely exists here, now just 
                 // connect it to the selected equipment

webgui/globals.inc

@@ -56,6 +56,8 @@ $g_scriptname = basename($_SERVER['SCRIPT_NAME']);
 
 require 'config.inc';
 
+umask(0027); // no rights for world!
+
 // Localization
 
 $lang = get_browser_lang(['de', 'en']);