Ticket #10205: 10205.diff

wp-admin/includes/file.php

@@ -864 +864 @@
                 $temp_file_name = $context . 'temp-write-test-' . time();
                 $temp_handle = @fopen($temp_file_name, 'w');
                 if ( $temp_handle ) {
-                        if ( getmyuid() == @fileowner($temp_file_name) )
+                        // Compare the owning UID of WordPress files to that of the files WordPress/PHP Creates
+                        // This ensures that all core files remain owned by the same user and do not "leak" to the PHP processes user during upgrades
+                        // This is a step more than simple write access, designed to ensure 100% compatibility rather than 90% compat with certain configurations
+                        // Changing this to only require write access is possible, but at the detriment that many FTP configurations & quota configurations used by shared hosts will become inoperable, and/or open up WordPress files to being modified by other accounts PHP scripts in the event of a configuration change.
+                        // Any server using a per-user PHP-fpm, suExec, or, suPHP configuration will PASS with the below.
+                        // A server with files owned by 'johndoe', and PHP executing as 'apache' will FAIL.
+                        // eg:
+                        // fail:
+                        //  getmyuid() == fileowner(__FILE__) == 501; // johndoe
+                        //  posix_getuid() == fileowner( $temp_file_name ) == 500; // apache
+                        // pass:
+                        //  getmyuid() == fileowner(__FILE__) == posix_getuid() == fileowner( $temp_file_name ) == 501; // johndoe
+                        //
+                        $uid_of_wordpress_files = @fileowner( __FILE__ ); // getmyuid() also returns this, except it refers to the entry .php rather than this included file
+                        if ( $uid_of_wordpress_files && $uid_of_wordpress_files === @fileowner( $temp_file_name ) )
                                 $method = 'direct';
                         @fclose($temp_handle);
                         @unlink($temp_file_name);