I am trying to solve the question SETGID bit gets reset for newly created directories inside sites/default/files. Please Note the Update-2 there.

I want to know which method creates the directories like php, css and js inside the web/sites/default/files directory. I think the method or function which creates css and js abuse the chmod function because only PHP directories obeys the setgid (set group ID) bit rule.

  • Have you already had a look at the code yourself? Which part of it is totally unclear to you? – leymannx Nov 11 at 6:26
  • I am asking for the code snippet or link to the class or method so that I will try to understand it myself. – SkyRar Nov 11 at 15:15
  • Just scan the code base for chmod for example or for .htaccess. – leymannx Nov 11 at 15:29
  • Yeh. I already tried that. But there are many and I am confused as I am a beginner. – SkyRar Nov 11 at 15:44
up vote 1 down vote accepted

I think the method or function which creates css and js abuse the chmod function

There's no code that abuses chmod in Drupal. There simply couldn't be - the only interface to the system chmod that PHP provides is its own chmod function. It's not possible to abuse that function, it only accepts two basic parameters.

It would, of course, be possible to provide extra functionality via a custom PHP extension, but only you could know if you had such a thing installed.

But to answer your specific question:

I want to know which method creates the directories like php, css and js inside the web/sites/default/files directory

That's FileSystem::mkdir. You can see from looking at the handful of lines of code in there that there's no abuse of chmod - just the standard usage.

  • Yes but it seems, like Drupal 8.x currently using drupal_mkdir() which is deprecated. api.drupal.org/api/drupal/core%21includes%21file.inc/8.6.x . Can you please have a look on it. So I think this is why the setgid bit doesn't work proerly? – SkyRar Nov 12 at 16:41
  • Does it? I thought most core code was using the service. Regardless, you can invalidate your own conclusion by just reading the code in drupal_mkdir – Clive Nov 12 at 16:52

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.