id,summary,reporter,owner,description,type,status,priority,milestone,component,version,severity,resolution,keywords,cc
10423,get_filesystem_method() uses uses wrong owner for validation,cyberspice,dd32,"The function get_filesystem_method() creates a temporary file and then checks the ownership comparing it with the result of getmyuid().  getmyuid() does not return the owner of the web server process but of the file calling getmyid().  In this case wp-admin/includes/file.php.  This means that in order to support automatic update the Wordpress files have to be own by the same process as the webserver regardless of permissions on the files.  This is a potential security risk.

If posix_getiud() is used where available then the owner of the webserver process is compared to the ownership of the temp file.  The Wordpress files can be owned by someone else and the update system works as long as the webserver has permissions to write.

I have written more about this (together with a fix) in my bog.

[http://www.cyberspice.org.uk/blog/2009/07/15/wordpress-automatic-update-bug/]


",defect (bug),closed,normal,,Upgrade/Install,2.8.1,normal,duplicate,Upgrade close,