extern/django-helpdesk
1
0
Fork 1
mirror of https://github.com/django-helpdesk/django-helpdesk.git synced 2024-12-13 10:21:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Set default attachment permissions to 0700, to address #591

Browse Source
This commit is contained in:
Garret Wassermann 2020-07-27 19:50:25 -04:00
parent fcde14b82c
commit 0a712381e0
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/install.rst
View File

@ -100,11 +100,11 @@ errors with trying to create User settings.
(substitute www-data for the user / group that your web server runs as, eg 'apache' or 'httpd')
If all else fails ensure all users can write to it::
If all else fails, you could ensure all users can write to it::
chmod 777 attachments/
This is NOT recommended, especially if you're on a shared server.
But this is NOT recommended, especially if you're on a shared server.
6. Ensure that your ``attachments`` folder has directory listings turned off, to ensure users don't download files that they are not specifically linked to from their tickets.

3
helpdesk/models.py
View File

@ -763,7 +763,8 @@ def attachment_path(instance, filename):
att_path = os.path.join(settings.MEDIA_ROOT, path)
if settings.DEFAULT_FILE_STORAGE == "django.core.files.storage.FileSystemStorage":
if not os.path.exists(att_path):
os.makedirs(att_path, 0o777)
# TODO: is there a better way to handle directory permissions more consistently?
os.makedirs(att_path, 0o700)
return os.path.join(path, filename)