Security: ensure that the file system cache is not world-writable

2007-03-10 11:05:52 -06:00 · 2007-03-10 11:05:52 -06:00 · 46a456b3ad
commit 46a456b3ad
parent 4ae46b32d8
1 changed files with 1 additions and 0 deletions
--- a/vendor/rails/actionpack/lib/action_controller/caching.rb
+++ b/vendor/rails/actionpack/lib/action_controller/caching.rb
@ -472,6 +472,7 @@ module ActionController #:nodoc:
        end

        def write(name, value, options = nil) #:nodoc:
+          File.umask(0006)
          ensure_cache_path(File.dirname(real_file_path(name)))
          File.open(real_file_path(name), "wb+") { |f| f.write(value) }
        rescue => e