Fix security misconfiguration vulnerability allowing local remote arbitrary code execution.

Maciej Malarz · Maciej Malarz · commit 3f135950bbf3 · 2015-08-31T16:34:50.000+02:00
diff --git a/lib/Doctrine/ODM/MongoDB/Hydrator/HydratorFactory.php b/lib/Doctrine/ODM/MongoDB/Hydrator/HydratorFactory.php
@@ -414,7 +414,7 @@ public function hydrate(\$document, \$data, array \$hints = array())
             $tmpFileName = $fileName . '.' . uniqid('', true);
             file_put_contents($tmpFileName, $code);
             rename($tmpFileName, $fileName);
-            chmod($fieldName, 0664);
+            chmod($fileName, 0664);
         }
     }
 

Original file line number	Diff line number	Diff line change
`@@ -414,7 +414,7 @@ public function hydrate(\$document, \$data, array \$hints = array())`
`414`	`414`	`$tmpFileName = $fileName . '.' . uniqid('', true);`
`415`	`415`	`file_put_contents($tmpFileName, $code);`
`416`	`416`	`rename($tmpFileName, $fileName);`
`417`		`- chmod($fieldName, 0664);`
	`417`	`+ chmod($fileName, 0664);`
`418`	`418`	`}`
`419`	`419`	`}`
`420`	`420`