mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-16 16:45:07 +00:00
Ignacio Nelson
4f10401c36
The image creates a fixed-uid www-data for php-fpm but left nginx on the alpine package's own `user nginx;` (uid 100), while nginx.conf's header claimed the two already matched. They did not, and the claim is why nobody looked. It matters because php-fpm hands nginx files to serve: protected downloads and thumbnails go out by X-Accel-Redirect. Directories the application creates on demand come out at Flysystem's private mode, 0700, owned by www-data — and traversing one of those means being its owner, since there are no group or other bits to fall back on. So the first thumbnail an installation ever renders answers 403, from nginx, with nothing in the application's log to show for it (#1614). Pointing the directive at www-data is half the fix. /var/lib/nginx and its tmp/ arrive from the package owned by the old user, and nginx recreates only the leaf temp directories at boot — as the new user, so they look correct while their parent stays untraversable. Every request nginx buffers to disk then fails with a bare 500 that never reaches php-fpm, which is every upload chunk, which is every upload (#1618). Fixing one without the other trades a broken thumbnail for a broken upload, so both land together. Verified by building the image three ways and driving a real upload and thumbnail through each: unchanged, the part PUT succeeds and the thumbnail 403s; with the user directive alone, the thumbnail works and the part PUT is a bare nginx 500 with "open() /var/lib/nginx/tmp/client_body/0000000001 failed (13: Permission denied)"; with both, the chunked upload completes, the thumbnail renders, and the file downloads back byte for byte. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>