Fix security misconfiguration vulnerability allowing local remote arbitrary code execution.

Author: Maciej Malarz

CacheWarmer/HydratorCacheWarmer.php

@@ -56,7 +56,7 @@ public function warmUp($cacheDir)
         // we need the directory no matter the hydrator cache generation strategy.
         $hydratorCacheDir = $this->container->getParameter('doctrine_mongodb.odm.hydrator_dir');
         if (!file_exists($hydratorCacheDir)) {
-            if (false === @mkdir($hydratorCacheDir, 0777, true)) {
+            if (false === @mkdir($hydratorCacheDir, 0775, true)) {
                 throw new \RuntimeException(sprintf('Unable to create the Doctrine Hydrator directory (%s)', dirname($hydratorCacheDir)));
             }
         } else if (!is_writable($hydratorCacheDir)) {

CacheWarmer/ProxyCacheWarmer.php

@@ -56,7 +56,7 @@ public function warmUp($cacheDir)
         // we need the directory no matter the proxy cache generation strategy.
         $proxyCacheDir = $this->container->getParameter('doctrine_mongodb.odm.proxy_dir');
         if (!file_exists($proxyCacheDir)) {
-            if (false === @mkdir($proxyCacheDir, 0777, true)) {
+            if (false === @mkdir($proxyCacheDir, 0775, true)) {
                 throw new \RuntimeException(sprintf('Unable to create the Doctrine Proxy directory (%s)', dirname($proxyCacheDir)));
             }
         } else if (!is_writable($proxyCacheDir)) {

DependencyInjection/Compiler/CreateHydratorDirectoryPass.php

@@ -31,7 +31,7 @@ public function process(ContainerBuilder $container)
         // Create document proxy directory
         $hydratorCacheDir = $container->getParameter('doctrine_mongodb.odm.hydrator_dir');
         if (!is_dir($hydratorCacheDir)) {
-            if (false === @mkdir($hydratorCacheDir, 0777, true)) {
+            if (false === @mkdir($hydratorCacheDir, 0775, true)) {
                 exit(sprintf('Unable to create the Doctrine Hydrator directory (%s)', dirname($hydratorCacheDir)));
             }
         } elseif (!is_writable($hydratorCacheDir)) {

DependencyInjection/Compiler/CreateProxyDirectoryPass.php

@@ -31,7 +31,7 @@ public function process(ContainerBuilder $container)
         // Create document proxy directory
         $proxyCacheDir = $container->getParameter('doctrine_mongodb.odm.proxy_dir');
         if (!is_dir($proxyCacheDir)) {
-            if (false === @mkdir($proxyCacheDir, 0777, true)) {
+            if (false === @mkdir($proxyCacheDir, 0775, true)) {
                 exit(sprintf('Unable to create the Doctrine Proxy directory (%s)', dirname($proxyCacheDir)));
             }
         } elseif (!is_writable($proxyCacheDir)) {