#30004: Set default FILE_UPLOAD_PERMISSION to 0o644.
-------------------------------------+-------------------------------------
Reporter: Evgeny Arshinov | Owner: Himanshu
Type: | Lakhara
Cleanup/optimization | Status: assigned
Component: File | Version: master
uploads/storage |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Himanshu Lakhara):
Replying to [comment:16 Tim Graham]:
> The bit about "When :setting:`FILE_UPLOAD_PERMISSIONS` is set to
``None``, ..." seems out of place in the checklist, however, there may
still be some value in describing cases in which the new default doesn't
make sense (if any).
Yes, It is out of place. I could think of one case when a developer might
want to change the new default.
Consider the following scenario. We have a Django application which allows
a user to upload pictures. Let's say this app runs in a process-A running
as some system user-1. Now we have another process-B which modifies this
image in place(maybe removing colors that the human eye cannot recognize
or shrinking the image etc.). This image manipulation process is run as
some other system user-2.
Now in order for process B to modify these images, we would require to set
FILE_UPLOAD_PERMISSIONS to '0o646'(assuming process-B is other than
group).
I understand this is not a great way to do such manipulation. We probably
want to do this in a different way by making a copy original image before
process-B modifies it. This is just an example.
So there might be situations when the new default doesn't make sense. Even
in these cases, I'm not sure whether putting in the deployment checklist
is necessary. The reason is setting page now explains what is the new
behavior and default deployment option is better now. I'm not sure what
additional information we could add to the checklist.
--
Ticket URL: <https://code.djangoproject.com/ticket/30004#comment:18>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.4f997793781348555d13e0f0acdb40ca%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
