copy not move uploaded files FS#2465

This fixes problems with setgid bits on the media directory

1 files changed, 18 insertions, 1 deletions

diff --git a/inc/media.php b/inc/media.php
index 794aab8aa..6941aa61a 100644
--- a/inc/media.php
+++ b/inc/media.php
@@ -296,7 +296,7 @@ function media_upload($ns,$auth,$file=false){
     $res = media_save(array('name' => $file['tmp_name'],
                             'mime' => $imime,
                             'ext'  => $iext), $ns.':'.$id,
-                      $INPUT->post->bool('ow'), $auth, 'move_uploaded_file');
+                      $INPUT->post->bool('ow'), $auth, 'copy_uploaded_file');
     if (is_array($res)) {
         msg($res[0], $res[1]);
         return false;
@@ -305,6 +305,23 @@ function media_upload($ns,$auth,$file=false){
 }
 
 /**
+ * An alternative to move_uploaded_file that copies
+ *
+ * Using copy, makes sure any setgid bits on the media directory are honored
+ *
+ * @see   move_uploaded_file()
+ * @param string $from
+ * @param string $to
+ * @return bool
+ */
+function copy_uploaded_file($from, $to){
+    if(!is_uploaded_file($from)) return false;
+    $ok = copy($from, $to);
+    @unlink($from);
+    return $ok;
+}
+
+/**
  * This generates an action event and delegates to _media_upload_action().
  * Action plugins are allowed to pre/postprocess the uploaded file.
  * (The triggered event is preventable.)