PraxisAI
Sign in
← All challenges
easydjango/django · v3.0

Set default FILE_UPLOAD_PERMISSION to 0o644.

webormbase e7fd69d051
Mode

60 minutes, the full token budget.

Sign in to start →
  • Time limit60 min
  • Token budgetup to 1M
  • Worth up to135 XP

Opens VS Code with an AI agent in a new tab. Prompts, tokens, tool calls and test runs are recorded and scored.

Problem statement

Description

Hello,
As far as I can see, the ​File Uploads documentation page does not mention any permission issues.
What I would like to see is a warning that in absence of explicitly configured FILE_UPLOAD_PERMISSIONS, the permissions for a file uploaded to FileSystemStorage might not be consistent depending on whether a MemoryUploadedFile or a TemporaryUploadedFile was used for temporary storage of the uploaded data (which, with the default FILE_UPLOAD_HANDLERS, in turn depends on the uploaded data size).
The tempfile.NamedTemporaryFile + os.rename sequence causes the resulting file permissions to be 0o0600 on some systems (I experience it here on CentOS 7.4.1708 and Python 3.6.5). In all probability, the implementation of Python's built-in tempfile module explicitly sets such permissions for temporary files due to security considerations.
I found mentions of this issue ​on GitHub, but did not manage to find any existing bug report in Django's bug tracker.

The environment starts at commit e7fd69d051ea (django/django 3.0), dependencies installed and tests runnable from the first minute. You are graded by hidden tests taken from the fix that was actually merged upstream.