Check for current user to have the same id then the owner of the config ...

[DeepDiver1975]

...file - fixes #12307

@LukasReschke @PVince81 @karlitschek

[karlitschek]

nice 👍

[DeepDiver1975]

I'm asking my self if this is a too hard check - shall we ask the user to continue on his own risk?

[LukasReschke]

I think this non-bypassable check is reasonable if we add some documentation about this. 👍

@carlaschroder

[ghost]

Refer to this link for build results (access rights to CI server needed):
https://ci.owncloud.org//job/pull-request-analyser-ng-simple/6434/
👍 Test PASSed. 👍

[MorrisJobke]

I just checked again: posix_getpwuid isn't available in my PHP even if PHP is compiled with --enable-posix=shared. Ideas?

[MorrisJobke]

Ah. posix.so needs to be enabled. Can we add a check for this extension or should we enforce this extension just for this check?

[scrutinizer-notifier]

The inspection completed: No new issues

[RobinMcCorkell]

This breaks my workflow (I know, I know 😆): I point my web server directly at my git repository, but use ACLs so that the web server can write to the important directories. Unfortunately after this PR I can no longer run occ. What about checking if config.php, or some other core object like data/, is writable? That is the real requirement here as I see it.

[DeepDiver1975]

That is the real requirement here as I see it.

No - here is an example:

config.php is owned by www-data
root can write to config.php
in case files are touches by occ - the owner is getting changed to root
www-data can no longer access the changed files

[RobinMcCorkell]

@DeepDiver1975 Ah, true. Perhaps it'd be best not to check the owner of config.php then, but rather an unimportant file generated by oC, like data/.ocdata (that is unlikely to be edited by the administrator, ever)? Or will that cause issues when it comes to using an object store?