capistrano-secure-permissions 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 61162a6f257134a19631b9450fe6dcf53e415037
-  data.tar.gz: a770f3a0595676e402882b03e68f91ccd8d5b0aa
+  metadata.gz: 4d04ac83ff009a67d9344c79aaa65ceb30df544f
+  data.tar.gz: 58e630cf73831fb1fdc3d29f44bb2dad886d2e37
 SHA512:
-  metadata.gz: 9a3b387cc3dab20d0a3c79aa5ec0a2747df95e491c0129da4c96596e338998bb03221cf5493076f9f9230ced983e4ff1d0ceec04549573102b36a123a1beb627
-  data.tar.gz: fa28095fba247d52b21d7a440acc8a3021c15f6cc24d5eeae5897c07a8eb4e13f4dd01d333718215147f92a8bb2adfa7fbf73ce6a50660bc4b105ed1cdf33c0d
+  metadata.gz: 59cda97ac2c3362347b96c159fef6a1fa213700a7a1838150f447610bf596a242b06b1a1eee7837b5e12336fa725af5a402edace6a973ffc816310064e40a739
+  data.tar.gz: ce07c047574a95f733cc14c22d7dfafacc4a6e0be08132f8d6cbcb1c15773e05e5e592423eedf68ea202763df926b15ceb156005856737b6b1159fe08e75c004

data/VERSION

@@ -1 +1 @@
-2.0.1
+2.0.2

data/capistrano-secure-permissions.gemspec

@@ -2,11 +2,11 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: capistrano-secure-permissions 2.0.1 ruby lib
+# stub: capistrano-secure-permissions 2.0.2 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "capistrano-secure-permissions"
-  s.version = "2.0.1"
+  s.version = "2.0.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]

data/lib/capistrano/tasks/secure-permissions.rake

@@ -34,19 +34,22 @@ namespace :secure_permissions do
       # Public is writable by app_user by default, so exclude that one.
       # To avoid going through the files twice.
       writable_dirs = fetch(:writable_dirs, fetch(:linked_dirs)).
-        reject { |dir| dir.start_with?('public/') }.
-        map { |dir| shared_path.join(dir) }
+        reject { |dir| dir.start_with?('public/') }
       # All of shared readable by app_user.
-      readable_dirs = shared_path.children().map(&:basename) - writable_dirs
+      # Try to subtract the writable_dirs, to avoid going through them twice.
+      # But won't subtract public/system for instance... :(
+      readable_dirs = within(shared_path) { capture(:ls, '-A').lines.map(&:chomp) } - writable_dirs
 
       execute :setfacl, '-m', "u:#{web_user}:x,d:u:#{web_user}:x,u:#{app_user}:rx,d:u:#{app_user}:rx", shared_path
-      execute :setfacl, '-R', '-m', "u:#{app_user}:rx,d:u:#{app_user}:rx", *readable_dirs
-      # Set permissions for files in public, readable by web_user and writable by app_user.
-      # Also make sure that deploy_user retains access, to the files that app_user creates.
-      execute :setfacl, '-R', '-m', "u:#{web_user}:rx,u:#{app_user}:rwx,u:#{deploy_user}:rwx,d:u:#{deploy_user}:rwx,d:u:#{web_user}:rx,d:u:#{app_user}:rwx", shared_path.join('public')
-      # Allow app_user access to writable_dirs in shared
-      # Also make sure that deploy_user retains access, to the files that app_user creates.
-      execute :setfacl, '-R', '-m', "u:#{app_user}:rwx,d:u:#{app_user}:rwx", *writable_dirs
+      within shared_path do
+        execute :setfacl, '-R', '-m', "u:#{app_user}:rx,d:u:#{app_user}:rx", *readable_dirs
+        # Set permissions for files in public, readable by web_user and writable by app_user.
+        # Also make sure that deploy_user retains access, to the files that app_user creates.
+        execute :setfacl, '-R', '-m', "u:#{web_user}:rx,u:#{app_user}:rwx,u:#{deploy_user}:rwx,d:u:#{deploy_user}:rwx,d:u:#{web_user}:rx,d:u:#{app_user}:rwx", 'public'
+        # Allow app_user access to writable_dirs in shared
+        # Also make sure that deploy_user retains access, to the files that app_user creates.
+        execute :setfacl, '-R', '-m', "u:#{app_user}:rwx,d:u:#{app_user}:rwx", *writable_dirs
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-secure-permissions
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Rune Schjellerup Philosof