[Django] #31921: Python 3.7: new behavior of os.makedirs breaks FileSystemStorage permissions on intermediate directories

Django

unread,

Aug 20, 2020, 2:57:32 PM8/20/20

to django-...@googlegroups.com

#31921: Python 3.7: new behavior of os.makedirs breaks FileSystemStorage
permissions on intermediate directories
-------------------------------------+-------------------------------------
Reporter: WhiteSage | Owner: nobody
Type: Bug | Status: new
Component: File | Version: 3.1
uploads/storage | Keywords: python3.7 makedirs
Severity: Normal | permissions
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
From the python os library documentation
(https://docs.python.org/3/library/os.html), regarding os.makedirs:
{{{
Changed in version 3.7: The mode argument no longer affects the file
permission bits of newly-created intermediate-level directories.
}}}
As FileSystemStorage._save() directly calls os.makedirs all intermediate
folders will be created with 777 permissions, ignoring the
directory_permissions_mode member field.

Steps to reproduce:

{{{
django-admin startproject bugreport
}}}

Append to settings.py

{{{
STATIC_ROOT = BASE_DIR / 'static'

FILE_UPLOAD_DIRECTORY_PERMISSIONS = 0o750
}}}

Call
{{{
python manage.py collectstatic
}}}

Intermediate folders such as static/admin will have permissions 777.

Note: python version at least 3.7 is required!

Could have security implications when running on a production server.

--
Ticket URL: <https://code.djangoproject.com/ticket/31921>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

Django

unread,

Aug 21, 2020, 2:06:52 AM8/21/20

to django-...@googlegroups.com

#31921: Python 3.7: new behavior of os.makedirs breaks FileSystemStorage
permissions on intermediate directories
-------------------------------------+-------------------------------------
Reporter: WhiteSage | Owner: nobody
Type: Bug | Status: new

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by felixxm):

* version: 3.1 => 2.2
* severity: Normal => Release blocker
* stage: Unreviewed => Accepted

Comment:

Thanks.

Security issues should be reported privately via
secu...@djangoproject.com

--
Ticket URL: <https://code.djangoproject.com/ticket/31921#comment:1>

Django

unread,

Aug 21, 2020, 2:45:11 AM8/21/20

to django-...@googlegroups.com

#31921: Python 3.7: new behavior of os.makedirs breaks FileSystemStorage
permissions on intermediate directories
-------------------------------------+-------------------------------------
Reporter: WhiteSage | Owner: nobody
Type: Bug | Status: new

Has patch: 0 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Claude Paroz):

It is not true that intermediate folders will have permissions `777`. The
current user umask will still apply, so on my system, intermediate
directories are created with `755` permissions.

--
Ticket URL: <https://code.djangoproject.com/ticket/31921#comment:2>

Django

unread,

Aug 21, 2020, 5:45:52 AM8/21/20

to django-...@googlegroups.com

#31921: Python 3.7: new behavior of os.makedirs breaks FileSystemStorage
permissions on intermediate directories
-------------------------------------+-------------------------------------

Reporter: WhiteSage | Owner: felixxm
Type: Bug | Status: assigned

Has patch: 0 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by felixxm):

* owner: nobody => felixxm
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/31921#comment:3>

Django

unread,

Sep 1, 2020, 4:53:34 AM9/1/20

to django-...@googlegroups.com

#31921: Python 3.7: new behavior of os.makedirs breaks FileSystemStorage
permissions on intermediate directories
-------------------------------------+-------------------------------------

Reporter: WhiteSage | Owner: felixxm
Type: Bug | Status: closed

Component: File | Version: 2.2
uploads/storage |

Severity: Release blocker | Resolution: fixed

Keywords: python3.7 makedirs | Triage Stage: Accepted
permissions |

Has patch: 0 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------