[Server Bug]: incorrect file permissions set in config/filesystems.php

Description

Best practice for deploying an application like Pixelfed is to create a dedicated user (e.g. pixelfed) and provide appropriate access to www-data (or equivalent) for the web access, with www-data being added to the pixelfed group so as to have proper access.

With that in mind and also to adhere to Linux nominal file permissions: config/filesystems.php should have two lines modified as follows:

Line 52: 0600 is too restrictive, group (which includes only www-data) should also have read access, replace

- 'private' => 0600
+ 'private' => 0640

Line 56: 0711 makes no sense and does not allow reading by members of the group (which includes only www-data), replace

- 'private' => 0711
+ 'private' => 0750

Also, I find that when pulling the project tree, I have default permissions of directories set to 775 and of files set to 664. Default permissions for directories should be 755 and of files should be 644.

Finally, the official documentation which changes owner / group to www-data (or equivalent like http) is not a good practice as that user is created and owned by Nginx (or equivalent), a dedicated user should be created for Pixelfed as said above.

Note however that users who still prefer it that way or who have already deployed like this will be unaffected by those changes in config/filesystems.php as www-data (or its equivalent) will retain all access as the owner, and that will not add access to anyone else as www-data group has no other member, so this change is non-breaking and adds no security hole.

Steps to reproduce

Failing these settings in config/filesystems.php and deploying using pixelfed user, issues in file access are raised blocking the loading of some files.

Pixelfed version

All

Acknowledgements

Yes