Folder permissions stop /out directory from being viewed offline

[RGBboy]

Is it possible to get docpad to create permissions on folders so they can be viewed offline? Currently it creates the permission 700 on all folders. In order for me to change them I must run a chmod to get the permissions I need. Can this be changed so directories get a 755 permission created? Or better yet, make the permission level customisable in the package.json file?

[balupton]

This is a good idea, not sure what way would be best to implement this. Perhaps we should keep the same permissions as the source document. Happy to review pull requests and continue the discussion.

[DjebbZ]

I think 744 for files (only reading is necessary) and 755 for directories. I'd even say 644 and 655 to be more secure. Even 640 and 650, and give group ownership to the web server (www-data for instance), but for nodejs I have no idea how it should done properly and securely. May have a look at Jekyll since the system has to be secure to be hosted on Github.

[balupton]

DocPad v4.0 now does a differential replace on the out directory, so you should only have to set your permissions once and docpad will then respect that. Can you confirm please? Thanks mate :)

[DjebbZ]

Not tested yet in DocPad v4, but bringing a proper and secure set of permissions from the outside. The following is taken from drupal.org documentation (I've used this CMS a lot for the past 3 years).

The out folder and all subsequent files and folders should be belong to you (your user, and not root!), and have the group set to www-data (Apache user in Linux) or www (Apache user in OS X). No idea for Windows neither IIS/NGinX, sorry. Then files permissions should be set to 640 (read : user=rw,group=r,others=NULL), and folders permissions to 750 (read : user=rwx,group=rx,others=NULL). Here's a small set of commands that just do it, assuming greg is the site owner (you may need to sudo some of these commands) :

# Move to site's out directory
cd /path_to_docpad_site/out
# Change ownership of all files/folders in out, including out itself
chown -R greg:www-data .
# OR www on OS X
# Change all folders permissions to 750
find . -type d -exec chmod u=rwx,g=rx,o= {} \;
# Change all files permissions to 640
find . -type f -exec chmod u=rw,g=r,o= {} \;

You should be good to go.

[DjebbZ]

@balupton I just updated to DocPad v4.1.1. Then changed the files/folders permissions as I just wrote above. After docpad watch and a few changes in the files, no permissions were harmed by the generation process. I can confirm it works :) Great !

[balupton]

Woooooooooo! Closing.

Note that this is as much as DocPad can do, as there is no cross-platform permission changing ability in node yet. (I believe it is coming in the future).

[DjebbZ]

Well, it doesn't work perfectly :/

To manage images simply in the site I'm creating I created a src/public/images/events folder where I placed images. I reference the image name from the documents metadata and then just recreate the proper path in the document's layout. The path is good, but the out/images/events folder doesn't respect the permissions of src/public/images/events. The src/.../events folder is (in my installation) 755, but in the out directory its equivalent is 700, so the images are not viewable (403 Forbidden). In the end I had to set this permission manually.

[stephanlough]

The permissions in out should directly inherit those in src. This is the simplest and most logical solution.

Currently (with v6.21.4) you can't distribute a DocPad project without an out structure because it will be broken when generated from scratch. If you add a new folder to your src while developing, the output will also be broken.

This is dangerous when developing with the DocPad server because you could accidentally deploy a structure with broken permissions.

Node does let you access modes of existing files/folders where supported, see here: nodejs/node-v0.x-archive#3045

I took a shot at making a patch but the main problem is in bal-util which DocPad uses for fs stuff:
https://github.com/balupton/bal-util/blob/ed16e426d0b1d0fd467d48368e1d9c762db59c3a/src/lib/paths.coffee#L408

[balupton]

@stephanlough great idea.

Keen to hear your thoughts or code on how we can make a patch work.

[deitch]

I just came across this one as well. Any update? I actually did deploy a broken web site, but fortunately caught it quickly before any damage caused. :-(

[stephanlough]

A quick fix would be to use the process umask when creating folders in ensurePath from bal-util.
https://github.com/balupton/bal-util/blob/master/src/lib/paths.coffee#L404

# Success
mode = 0o777 & ~process.umask()
balUtilPaths.mkdir path, mode, (err) ->

That's what node-mkdirp does: https://github.com/substack/node-mkdirp/blob/master/index.js#L9

[deitch]

Oooh, umask is well said. It should happen inside docpad generate but this is a nice solution.

How did you get it to execute when generate is finished? Does docpad.cson (or similar) have post-generate hooks?

[deitch]

Hmm, as an interim fix, could we modify the docpad.cson to do that on generateBefore?

docpadConfig =
    events: 
        generateBefore: (opts) ->
            mode = 0777 & ~process.umask()

Just adopting what you did above?

[deitch]

Nah, doesn't work, don't know why.