MySQL Bugs: #56403: Saving over readonly file

Bug #56403	Saving over readonly file
Submitted:	31 Aug 2010 12:33	Modified:	25 Nov 2010 11:31
Reporter:	aaa bbb	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Workbench: Modeling	Severity:	S3 (Non-critical)
Version:	5.2.26, 5.2.28	OS:	Linux (Ubuntu 10.4)
Assigned to:	Alfredo Kojima	CPU Architecture:	Any
Tags:	linux, permission, readonly, ubuntu, wb, workbench

Description:
When saving over a readonly file the file permissions get changed to read/write.

Additional info:
We use WB with files stored in SVN, as the WB file is a binary (ZIP) we utilize svn-locks which set the file permissions to read only for all.

After user checks out the file and obtains a lock it will be changed to readwrite, but this behavior is broken due to WB changing the permission directly.

How to repeat:
create readonly file, open in WB, save, check permissions (will be readwrite)
(might be necessary to use svn lock behavior to reproduce, if not reproducible without svn)

How can this be a security issue? If you try to save over a read-only file you are told it is read-only and if you agree (and only then) the permissions are changed. Likewise, if you want to save such a file you have a lock, as per your scenario, so how can the file be read-only anymore?

Unfortunately we are not told that the permission will be changed. It just saves it with changing permission.

We confirmed that the file is readonly (in nautilus) before opening it in WB.
On save it just completes saving it, without any error message. After that the file is readwrite.

This happens when you do not request a lock in the SVN, but just open the locked / readonly file.

With 5.2.28 on Ubuntu 10.04 when I try to save model with .mwb file having mode 444, empty dialog box (without title or buttons) appears and Workbench hangs until forced quit. There is definitely a problem here.

saving to a readonly model will raise a warning that the file is marked readonly and ask if you want to overwrite. If you choose to overwrite and workbench is not able to change the file permission to read/write WB will correctly notify about not being able to write to that file.

confirmed in repository

An entry has been added to the 5.2.31 changelog:

When saving over a read-only file, MySQL Workbench changed the file permissions to read-write.