Public bug reported:
Binary package hint: sympa
The files under /var/lib/sympa/static_content are only readable by the
sympa user. I see no reason why content meant to be displayed on the web
should be restricted to a specific user, and it also causes a bit of
pain.
By default, wwsympa.fcgi and sympa_soap_server.fcgi run as the sympa
user, but the web server runs as www-data. This works pretty well,
except that you get a 404 on all CSS. Running the web server as the
sympa user is indeed possible, but it is not very convenient when
running multiple web services on the same machine. I therefore propose
that the CSS files in /var/lib/sympa/static_content are made world
readable, so apache can reach them no matter what user it is running as.
Now, let's look at the technicalities. The following is run by the sympa
postinst script (prefixed by line numbers):
337 chown -R sympa.sympa /var/spool/sympa/wws* /var/lib/sympa/wws*
/var/lib/sympa/static_content*
338 chmod -R ug=rwX,o=X /var/spool/sympa/wws* /var/lib/sympa/wws*
/var/lib/sympa/static_content*
In /usr/lib/cgi-bin/sympa/wwsympa.fcgi, the following code is found
(prefixed by line numbers):
4975 sub do_skinsedit {
[...]
5005 foreach my $css
('style.css','print.css','fullPage.css','print-preview.css') {
[...]
5040 ## Make the CSS readable to anyone
5041 chmod 0775, "$dir/$css";
5042 }
This leads me to believe that this would have worked had it not been for
the chmodding in the postinst script (although setting the execute bit
on a CSS file also seems a bit odd, if you ask me). Running do_skinsedit
after installation would probably make the files world readable again,
but I have not figured out how to make sympa call this function yet. And
even if that worked an upgrade or reinstall of the sympa package would
chmod the files back to ug=rwX,o=X.
** Affects: sympa (Ubuntu)
Importance: Undecided
Status: New
--
/var/lib/sympa/static_content is not world readable
https://bugs.launchpad.net/bugs/256028
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
