This question has already been asked on this forum here and has this accepted answer, but I don't feel this solution fully covers the problems.
After upgrading to 1.9.2.3, files uploaded via the upload manager are now given permissions of 0640, rather than 0777 as they were. The problem is that in a shared hosting environment with SuPHP, the uploaded files have an owner and group of myaccount:myaccount, but the webserver runs as the user apache or nobody, so the new permissions of 0640, mean that apache cannot read and serve up the images.
As far as I know, there are two solutions to this problem, one solution given in the accepted answer above is to override lib/Verien/File/Uploader.php and change the chmod on line 219 to 0644 and the mkdir on line 541 to 0755. The alternate solution requires changing the ownership of all files in the webroot to myaccount:webserver, and then setting the guid bit for all directories. This means that all files with 0640 are readable by the webserver and all files created by PHP or upload by FTP continue to have the myaccount:webserver ownership.
I accept that changing uploaded file permissions to prevent them being globally executable makes a lot of sense, but this could have been achieved by a reduction of permissions from 0777 to 0644, not all the way 0640. Surely PCI compliance would have been achieved just by preventing the files from being executable?
As a temporary measure I've implemented the the first solution; overriding the Uploader.php. If Magento plans to release a patch which will put uploaded file permissions to 0644, then I'll leave my override in place. If there is no plan to patch then I'll adjust my servers as I'd rather not have a library override on my systems.
Thanks
Dom
