Unit/System Tests PR-6.1-dev Pending

User tests: Successful: Unsuccessful:

avatar tommyDoesDev
tommyDoesDev
3 Sep 2026

Pull Request resolves #48364.

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Set Joomla's standard 0644 file permissions after the local media adapter writes uploaded or updated files. This prevents restrictive server umasks from leaving Media Manager uploads with permissions such as 0600, which makes uploaded files inaccessible via URL and breaks Media Manager previews.

Added a regression unit test that simulates a restrictive umask during a Media Manager file upload and confirms the final file mode is 0644.

Testing Instructions

  1. Apply this Pull Request.
  2. Configure the PHP process with a restrictive umask such as 0077, or test in a hosting environment where uploaded files are currently created as 0600.
  3. In the administrator area, open Content > Media.
  4. Upload a valid JPG image.
  5. Confirm the uploaded file has permissions 0644.
  6. Confirm the uploaded file is accessible via its URL and has a working preview in Media Manager.

Automated checks run:

  • php -l plugins/filesystem/local/src/Adapter/LocalAdapter.php
  • php -l tests/Unit/Plugin/Filesystem/Local/Adapter/LocalAdapterTest.php
  • libraries/vendor/bin/phpunit --filter LocalAdapterTest tests/Unit/Plugin/Filesystem/Local/Adapter/LocalAdapterTest.php
  • libraries/vendor/bin/phpcs --standard=ruleset.xml plugins/filesystem/local/src/Adapter/LocalAdapter.php tests/Unit/Plugin/Filesystem/Local/Adapter/LocalAdapterTest.php
  • git diff --check

Actual result BEFORE applying this Pull Request

Media Manager uploads can inherit restrictive file permissions from the server/PHP umask, for example 0600. The upload succeeds, but the file cannot be accessed through the web server and previews do not work.

Expected result AFTER applying this Pull Request

Media Manager uploads are explicitly set to Joomla's default file permissions of 0644 after being written. Uploaded files are accessible via URL and previews work in Media Manager.

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar tommyDoesDev tommyDoesDev - open - 3 Sep 2026
avatar tommyDoesDev tommyDoesDev - change - 3 Sep 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 3 Sep 2026
Category ⇒ Front End Plugins Unit Tests
avatar brianteeman
brianteeman - comment - 3 Sep 2026

There was a reason you were given a template to complete when you submitted the PR. It was not for fun. Please update your PR with the relevant information - you can find the template here https://github.com/joomla/joomla-cms/blob/5.4-dev/.github/PULL_REQUEST_TEMPLATE.md

avatar tommyDoesDev tommyDoesDev - edited - 3 Sep 2026
avatar tommyDoesDev tommyDoesDev - change - 3 Sep 2026
The description was changed
avatar tommyDoesDev tommyDoesDev - edited - 3 Sep 2026
avatar mapexer
mapexer - comment - 3 Sep 2026

@brianteeman - my apologies! My first commit for joomla and completely missed the guidance, hope my revised comment is more informative :)

avatar brianteeman
brianteeman - comment - 3 Sep 2026

If the server has a restrictive umask then wouldnt it be the expected behaviour for that to be honored?

avatar HLeithner HLeithner - close - 3 Sep 2026
avatar HLeithner
HLeithner - comment - 3 Sep 2026

As brian guesses this would break server side security measurements, I'm closing this and the issue since it's a server configuration problem and not a Joomla problem.

Anyway thanks for your first contribution.

avatar HLeithner HLeithner - change - 3 Sep 2026
Status Pending ⇒ Closed
Closed_Date 0000-00-00 00:00:00 ⇒ 2026-09-03 18:20:29
Closed_By ⇒ HLeithner
Labels Added: Unit/System Tests PR-6.1-dev
avatar brianteeman
brianteeman - comment - 3 Sep 2026

I didn't guess I was being tactful

Add a Comment

Login with GitHub to post a comment