From 5c5ab6b8750a5168f0ae2a26bd5de41e0b6d9637 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=81=AD=E3=82=89=E3=81=B2=E3=81=8B=E3=81=A0?=
 <hkshirorom@yahoo.co.jp>
Date: Tue, 30 Jan 2024 18:12:38 +0900
Subject: [PATCH] fix: files and directories are created with the correct
 permissions (#2966)

---
 files/file.go     | 2 +-
 fileutils/file.go | 6 ++++--
 http/resource.go  | 6 +++---
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/files/file.go b/files/file.go
index f181f185..4d7c8f9f 100644
--- a/files/file.go
+++ b/files/file.go
@@ -24,7 +24,7 @@ import (
 	"github.com/filebrowser/filebrowser/v2/rules"
 )
 
-const PermFile = 0664
+const PermFile = 0644
 const PermDir = 0755
 
 // FileInfo describes a file.
diff --git a/fileutils/file.go b/fileutils/file.go
index 81aeffeb..fdf11225 100644
--- a/fileutils/file.go
+++ b/fileutils/file.go
@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 
 	"github.com/spf13/afero"
+
+	"github.com/filebrowser/filebrowser/v2/files"
 )
 
 // MoveFile moves file from src to dst.
@@ -40,13 +42,13 @@ func CopyFile(fs afero.Fs, source, dest string) error {
 
 	// Makes the directory needed to create the dst
 	// file.
-	err = fs.MkdirAll(filepath.Dir(dest), 0666) //nolint:gomnd
+	err = fs.MkdirAll(filepath.Dir(dest), files.PermDir)
 	if err != nil {
 		return err
 	}
 
 	// Create the destination file.
-	dst, err := fs.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775) //nolint:gomnd
+	dst, err := fs.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, files.PermFile)
 	if err != nil {
 		return err
 	}
diff --git a/http/resource.go b/http/resource.go
index 3a12538a..71c1b0d0 100644
--- a/http/resource.go
+++ b/http/resource.go
@@ -98,7 +98,7 @@ func resourcePostHandler(fileCache FileCache) handleFunc {
 
 		// Directories creation on POST.
 		if strings.HasSuffix(r.URL.Path, "/") {
-			err := d.user.Fs.MkdirAll(r.URL.Path, 0775) //nolint:gomnd
+			err := d.user.Fs.MkdirAll(r.URL.Path, files.PermDir)
 			return errToStatus(err), err
 		}
 
@@ -256,12 +256,12 @@ func addVersionSuffix(source string, fs afero.Fs) string {
 
 func writeFile(fs afero.Fs, dst string, in io.Reader) (os.FileInfo, error) {
 	dir, _ := path.Split(dst)
-	err := fs.MkdirAll(dir, 0775) //nolint:gomnd
+	err := fs.MkdirAll(dir, files.PermDir)
 	if err != nil {
 		return nil, err
 	}
 
-	file, err := fs.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775) //nolint:gomnd
+	file, err := fs.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, files.PermFile)
 	if err != nil {
 		return nil, err
 	}