.htaccess has incorrect permissions after installation

[i3anaan]

Having used the WordPress installation instructions and the .htaccess was installed on the server with 0600 permissions, instead of 0644 permissions (like all the other files). This caused our installation to function incorrectly, denying access to at least the login page.

Steps to reproduce:

• Install wordpress
• Fill in online 'setup' (the one where you choose admin credentials)
• Be redirected to the wp-login.php
• Get a 403 error

[dd32]

Welcome to the WordPress Trac @i3anaan

WordPress doesn't specify what permissions the .htaccess file should be created as, defaulting to whatever the server defaults to.
A Server with a umask of 0066 seems unlikely, but appears to be the case here.

It looks to me like we can probably always set the file permissions to a minimum of 0644 using something like the following in the creation branch of insert_with_markers():

if ( $perms = fileperms( $filename ) ) {
	chmod( $filename, $perms | 0644 );
}

In order to test implementation details of this, it might be helpful to whomever patches this to put umask( 0066 ) into your wp-config.phpfile to simulate the reporters environment and test your patch's effectiveness.

[i3anaan]

Hey @dd32, thank you for your response!

I just want to verify that for now there is no further action required from my side?

[dd32]

@i3anaan Correct! We don't need anything from you at present, when there's a patch uploaded or a commit to WordPress testing a fresh WordPress install in a subdirectory install to verify it fixes it would be appreciated - but not needed.

Thanks for taking the time to report the issue!

[rcutmore]

Modify .htaccess to a minimum set of permissions during creation

[rcutmore]

Hi @dd32

I added 40572.patch to ensure a minimum set of permissions when creating the .htaccess file. I manually tested the patch and it resolves the issue for me when using a server umask of 0066. Should there be a unit test created for this?

[DrewAPicture]

Assigning ownership to mark the good-first-bug as "claimed".

[SergeyBiryukov]

In 47005:

Upgrade/Install: When creating the .htaccess file in insert_with_markers(), make sure it has 0644 as a minimum set of permissions.

Props rcutmore, dd32, i3anaan.
Fixes #40572.