fix(settings): stop reporting success when a settings write fails

WriteSettingToFile() opened the settings file with @fopen($f, "c+") and never
checked the result.  When the web user cannot write the file, the open returns
false and PHP 8 throws "TypeError: flock(): Argument #1 must be of type
resource, false given" -- but the API response is still HTTP 200, so the
browser's success handler runs and jGrowl reports "setting saved" for a value
that was never written.  The setting then reverts on the next page load, with
nothing in the UI to say why.

The way in is a stray root write.  Apache/PHP run as fpp, and FPP's own writers
put ownership back (PutFileContents -> SetFilePerms chowns to fpp; sed -i
preserves the owner), but anything running as root that replaces the file with
a fresh inode leaves it root:root.  Boot re-runs "chown -R fpp:fpp" over the
media directory, so the broken state lasts only until the next reboot -- which
is exactly long enough to look like a bug in whichever setting was being saved.

- WriteSettingToFile() returns bool, checks both the open and the write, and
  logs which setting was lost.
- On an unwritable file it re-asserts fpp ownership via sudo and retries once.
  Boot already asserts that same ownership, so the correct owner is not a
  guess, and one stray root write no longer disables saving for the rest of the
  uptime.
- PutSetting() returns 500 with a JSON error instead of {"status":"OK"}, and
  skips the apply/restart path so the running system cannot diverge from disk.

Existing callers ignore the new return value and are unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dkulp

www/api/controllers/settings.php

@@ -124,7 +124,17 @@ function PutSetting()
         $value = round(($value - 32) * 5 / 9);
     }
 
-    WriteSettingToFile($setting, $value);
+    // A failed write must not fall through to the apply/restart steps below:
+    // applying a value that isn't on disk leaves the running system and the
+    // settings file disagreeing, and the UI would show "setting saved" for a
+    // value that reverts on the next page load.
+    if (!WriteSettingToFile($setting, $value)) {
+        http_response_code(500);
+        return json(array(
+            "status" => "ERROR",
+            "message" => "Unable to save the '" . $setting . "' setting.  The settings file is not writable - check the FPP logs."
+        ));
+    }
 
     // Callers can pass ?skipApply=1 to persist the value WITHOUT running the
     // (sometimes expensive) side effects that apply it. This is used to write a

www/common.php

@@ -196,6 +196,50 @@ function custom_parse_ini_file($filename)
     return $settings;
 }
 
+/**
+ * Re-assert fpp ownership on a config file the web user cannot write.
+ *
+ * FPP runs "chown -R fpp:fpp" over the media directory at every boot (see
+ * setFileOwnership() in src/boot/FPPINIT_Config.cpp), so the correct owner is
+ * not a guess.  Anything running as root that replaces one of these files with
+ * a fresh inode - an editor, a shell redirect, a restore run by hand - leaves
+ * it root-owned, and every later write from the web UI fails until the next
+ * boot.  Repair it here so a single stray root write doesn't silently disable
+ * saving for the rest of the uptime.
+ *
+ * Returns true only if the file is writable afterwards.
+ */
+function RepairConfigFileOwnership($filename)
+{
+    global $SUDO;
+
+    // Nothing to repair if the file isn't there (fopen will create it) and
+    // nothing to repair to on a system with no fpp user, e.g. macOS.
+    if (!file_exists($filename) || posix_getpwnam('fpp') === false) {
+        return false;
+    }
+
+    $ids = GetFPPUserIds();
+    $file = escapeshellarg($filename);
+    exec($SUDO . " chown " . $ids['uid'] . ":" . $ids['gid'] . " " . $file .
+        " && " . $SUDO . " chmod 664 " . $file, $output, $return_val);
+
+    if ($return_val != 0 || !is_writable($filename)) {
+        return false;
+    }
+
+    error_log("Repaired ownership of '$filename', which was not writable by the web user.");
+    return true;
+}
+
+/**
+ * Write a single setting to the settings file, or to a plugin's config file.
+ *
+ * Returns true once the value is on disk (including when it was already the
+ * stored value), false if it could not be written.  Callers that tell a user
+ * the setting was saved MUST check the return - reporting success on a failed
+ * write shows a "saved" toast for a value that reverts on the next page load.
+ */
 function WriteSettingToFile($settingName, $new_setting_value, $plugin = "")
 {
     global $settingsFile;
@@ -207,6 +251,13 @@ function WriteSettingToFile($settingName, $new_setting_value, $plugin = "")
     }
 
     $fd = @fopen($filename, "c+");
+    if ($fd === false) {
+        $fd = RepairConfigFileOwnership($filename) ? @fopen($filename, "c+") : false;
+        if ($fd === false) {
+            error_log("WriteSettingToFile: cannot open '$filename' for writing; '$settingName' was NOT saved.");
+            return false;
+        }
+    }
     flock($fd, LOCK_EX);
     $tmpSettings = custom_parse_ini_file($filename);
     if (!isset($tmpSettings[$settingName]) || $tmpSettings[$settingName] != $new_setting_value) {
@@ -220,13 +271,19 @@ function WriteSettingToFile($settingName, $new_setting_value, $plugin = "")
                 $RevisedSettingsStr .= $key . " = \"" . $value . "\"\n";
             }
         }
-        file_put_contents($filename, $RevisedSettingsStr);
+        if (@file_put_contents($filename, $RevisedSettingsStr) === false) {
+            error_log("WriteSettingToFile: write to '$filename' failed; '$settingName' was NOT saved.");
+            flock($fd, LOCK_UN);
+            fclose($fd);
+            return false;
+        }
     }
     if ($plugin == "") {
         $settings[$settingName] = $new_setting_value;
     }
     flock($fd, LOCK_UN);
     fclose($fd);
+    return true;
 }
 
 /**