#29163: When uploading, if file size is greater than the
FILE_UPLOAD_MAX_MEMORY_SIZE, the permissions of the file on disk is screwed
up.
-------------------------------------+-------------------------------------
Reporter: | Owner: nobody
Jibinjohnkj |
Type: | Status: new
Uncategorized |
Component: File | Version: 2.0
uploads/storage |
Severity: Release | Keywords:
blocker | TemporaryFileUploadHandler
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
I have Nginx+Gunicorn server with Django running on Ubuntu 16.04 LTS. I
have a 'media' folder with appropriate ACL and umask setup. When
uploading, if file size is less than FILE_UPLOAD_MAX_MEMORY_SIZE things
work as expected.
{{{
getfacl sample.ipa
# file: sample.ipa
# owner: nobody
# group: nogroup
user::rw-
group::rwx #effective:-w-
mask::-w-
other::r--
}}}
But when the file size is larger than FILE_UPLOAD_MAX_MEMORY_SIZE, the
permissions get screwed up. See the difference in 'mask' and 'other'
permissions. Since 'other' cannot read the file, Django returns "403
Forbidden"
{{{
getfacl sample.ipa
# file: sample.ipa
# owner: nobody
# group: nogroup
user::rw-
group::rwx #effective:---
mask::---
other::---
}}}
If you increase FILE_UPLOAD_MAX_MEMORY_SIZE to greater than the actual
file size, the issue is solved.
Could be a problem related to TemporaryFileUploadHandler.
--
Ticket URL: <https://code.djangoproject.com/ticket/29163>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/054.b068b310e0781f229b106b0f865ab4f7%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
