Summary:	ASTERISK-14345: File Permissions On Voicemails Left To Multiple Recipients Incorrect
Reporter:	Muiz Motani (muiz)	Labels:
Date Opened:	2009-06-19 17:05:47	Date Closed:	2009-08-25 16:21:19
Priority:	Minor	Regression?	No
Status:	Closed/Complete	Components:	Applications/app_voicemail
Versions:		Frequency of Occurrence
Related Issues:
Environment:		Attachments:
Description:	It is possible to leave a single voicemail to multiple recipients using the following syntaz for the VoiceMail command: exten => s,1,VoiceMail(101&102&103) This will leave voicemail in the INBOX for extension 101, 102 and 103. The permissions for the voicemail audio file in 101 are correctly set to 0666. However, for the copies made in 102 and 103 the permissions are set to 0600. This means that scripts which run under a different user such as Apache running as apache can not read the file, hence vmail.cgi fails. It looks like the copy of the voicemail is done by copy_message() in app_voicemail.c and this function does not set the permissions of the copy.
Comments:	By: Muiz Motani (muiz) 2009-06-19 17:49:26 Sorry, made a mistake in "Reproducibility" field. This bug is Always reproducible. Don't know how to change that field once the bug has been submitted. By: Tilghman Lesher (tilghman) 2009-08-25 16:21:19 While this is absolutely true, because of the security implications of changing the file permissions midway through a release cycle, we decided not to alter 1.4 in this way.  In 1.6, we do indeed set the permissions to 0666, which will be modified by the process umask.  This is not something we're likely to change in 1.4 ever, and we'd recommend upgrading to 1.6 anyway.  If you did want to modify your copy of 1.4, understanding that this change will not be accepted, the function is copy() within main/file.c that would need the 0600 changed to 0666.