[Bug]: Webbased updater does not use 'localstorage.umask' settings

[mspbonn]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Using a non-standard umask:

config.php:
.
.
'localstorage.umask' => 0072
.
.

User files are created with permission 604.

Using webbased updater results in permission 640.

File permission 604 ist required at hetzner.com (see https://docs.hetzner.com/konsoleh/general/faq/file-authorization/)

Steps to reproduce

1. Set non-standard umask in config.php
2. Perform nexcloud or app upgrade
3. Check permission

Expected behavior

Correct usage of umask-setting.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[kesselb]

Thanks for your bug report 👍

https://github.com/nextcloud/server/blob/23573c4947a2d9a5db9907a76eb4151985ee6542/config/config.sample.php#L2278-L2287

The prefix localstorage means the configuration option is scoped to Nextcloud’s storage API when writing to the local file system. This option is not intended to affect files created by the updater.

I’ll move your request over to the updater repo, since as far as I know there’s nothing to be changed in server. I think it should work if you run the updater through the CLI and adjust the umask before starting it. Did you try that?

It sounds reasonable to add a configuration option "updater.umask" for such cases.

[mspbonn]

Running the updater in the commandline works fine. umask is set for the environment to 0072.

$ sg users "php83 YOUR_PATH/updater/updater.phar"

or

$ sg users "php83 YOUR_PATH/occ app:update --all"

results in correct permission and group assignment.
Running the updater from the webui sets wrong permissions.

Doing upgrades only in the commandline is a workaround for this issue.

[kesselb]

Related: nextcloud/server#52484