Ticket #8454: 8454.diff

django/conf/global_settings.py

@@ -252 +252 @@
 # (i.e. "/tmp" on *nix systems).
 FILE_UPLOAD_TEMP_DIR = None
 
+# The numeric mode to set newly-uploaded files to. See the chmod function here:
+# http://docs.python.org/lib/os-file-dir.html
+FILE_UPLOAD_PERMISSIONS = None
+
 # Default formatting for date objects. See all available format strings here:
 # http://www.djangoproject.com/documentation/templates/#now
 DATE_FORMAT = 'N j, Y'

django/core/files/storage.py

@@ -168 +168 @@
             else:
                 # OK, the file save worked. Break out of the loop.
                 break
-                
+
+        # Since it's possible that temporary files and in-memory saved files will end up
+        # with different permissions, allow for a common way of setting them.
+        if settings.FILE_UPLOAD_PERMISSIONS is not None:
+            os.chmod( full_path, settings.FILE_UPLOAD_PERMISSIONS )
+
         return name
 
     def delete(self, name):

docs/upload_handling.txt

@@ -150 +150 @@
         Which means "try to upload to memory first, then fall back to temporary
         files."
 
+    ``FILE_UPLOAD_PERMISSIONS``
+        The numeric mode (e.g. ``0644``) to set newly-uploaded files to.
+
+        If this is not specified, temporary files will be created with a mode of
+        ``0600``, while files saved to disk from memory will respect the current
+        umask value.
+
+        See the `documentation for chmod`_ for a list of mode bits.
+
 .. _settings: ../settings/
+.. _documentation for chmod: http://docs.python.org/lib/os-file-dir.html
 
 ``UploadedFile`` objects
 ========================