Summary:ASTERISK-14345: File Permissions On Voicemails Left To Multiple Recipients Incorrect
Reporter:Muiz Motani (muiz)Labels:
Date Opened:2009-06-19 17:05:47Date Closed:2009-08-25 16:21:19
Versions:Frequency of
Description:It is possible to leave a single voicemail to multiple recipients using
the following syntaz for the VoiceMail command:

exten => s,1,VoiceMail(101&102&103)

This will leave voicemail in the INBOX for extension 101, 102 and 103.
The permissions for the voicemail audio file in 101 are correctly set to
0666. However, for the copies made in 102 and 103 the permissions are
set to 0600. This means that scripts which run under a different user
such as Apache running as apache can not read the file, hence vmail.cgi

It looks like the copy of the voicemail is done by copy_message() in
app_voicemail.c and this function does not set the permissions of the
Comments:By: Muiz Motani (muiz) 2009-06-19 17:49:26

Sorry, made a mistake in "Reproducibility" field. This bug is Always reproducible. Don't know how to change that field once the bug has been submitted.

By: Tilghman Lesher (tilghman) 2009-08-25 16:21:19

While this is absolutely true, because of the security implications of changing the file permissions midway through a release cycle, we decided not to alter 1.4 in this way.  In 1.6, we do indeed set the permissions to 0666, which will be modified by the process umask.  This is not something we're likely to change in 1.4 ever, and we'd recommend upgrading to 1.6 anyway.  If you did want to modify your copy of 1.4, understanding that this change will not be accepted, the function is copy() within main/file.c that would need the 0600 changed to 0666.