Python 3.7: new behavior of os.makedirs breaks FileSystemStorage permissions on intermediate directories

[WhiteSage]

From the python os library documentation (​https://docs.python.org/3/library/os.html), regarding os.makedirs:

Changed in version 3.7: The mode argument no longer affects the file permission bits of newly-created intermediate-level directories.

As FileSystemStorage._save() directly calls os.makedirs all intermediate folders will be created with 777 permissions, ignoring the directory_permissions_mode member field.

Steps to reproduce:

django-admin startproject bugreport 

Append to settings.py

STATIC_ROOT = BASE_DIR / 'static'

FILE_UPLOAD_DIRECTORY_PERMISSIONS = 0o750

Call

python manage.py collectstatic

Intermediate folders such as static/admin will have permissions 777.

Note: python version at least 3.7 is required!

Could have security implications when running on a production server.

[Mariusz Felisiak]

Thanks.

Security issues should be reported privately via security@…

[Claude Paroz]

It is not true that intermediate folders will have permissions 777. The current user umask will still apply, so on my system, intermediate directories are created with 755 permissions.

[Carlton Gibson]

Fixed in 8d7271578d7b153435b40fe40236ebec43cbf1b9