Daily log file inaccessible by web when created by cli and vice-versa

[alexmerlin]

Error:

Fatal error: Uncaught ErrorException: fopen(/var/www/admin.dotkernel.localhost/html/config/autoload/../../log/error-log-2024-07-25.log): Failed to open stream: Permission denied in /var/www/admin.dotkernel.localhost/html/vendor/laminas/laminas-log/src/Writer/Stream.php:105

This issue affects all projects: API, Frontend and Admin

---

Log file properties when created by a web request:

-rw-r--r-- 1 apache apache 0 Jul 25 11:39 error-log-2024-07-25.log

Log file properties when created by a PHP command:

-rw-r--r-- 1 merlin merlin 0 Jul 25 11:41 error-log-2024-07-25.log

---

Checking groups for the user apache:

groups apache

Output:

apache : apache

---

Checking groups for my own user merlin:

groups merlin

Output:

merlin : merlin adm wheel cdrom apache docker

[alexmerlin]

@arhimede I seem to have found a fix for this issue!

Each log writer has its options where we need to tell the writer what permissions should a log file have on creation.

---

Example:

https://github.com/dotkernel/admin/blob/7.0/config/autoload/error-handling.global.php#L20

                    'FileWriter' => [
                        'name'     => 'stream',
                        'priority' => Logger::ALERT,
                        'options'  => [
                            'stream' => __DIR__ . '/../../log/error-log-{Y}-{m}-{d}.log',
                            'mode'   => 'a',
                            'chmod'  => 0666,

See the last 2 lines I added (mode and chmod):

• mode is already configured correctly in dot-log but we should still add it, to make sure this behavior does never change
• chmod is the important one - this give read/write permissions to owner, group and others (I tried 0660 but it did not work)

The fix could be applied:

• at individual project level (DK Admin, API, Queue and Frontend)
• in dot-log/src/Writer/Stream.php#L72 by replacing

+       private const int DEFAULT_PERMISSIONS = 0666;
...
-        ?int $filePermissions = null
+        ?int $filePermissions = self::DEFAULT_PERMISSIONS,

But setting those permissions as defaults might prove too permissive in some cases.

[arhimede]

@alexmerlin Perfect, let's plan it on all projects

1. set 666 as a default value
2. release a new version of dot-log for both branches
3. apply to admin, api, queue, etc

[alexmerlin]

It's implemented in dot-log in the following releases:

• https://github.com/dotkernel/dot-log/releases/tag/4.0.6
• https://github.com/dotkernel/dot-log/releases/tag/4.1.4
• https://github.com/dotkernel/dot-log/releases/tag/5.3.1

The DK projects would automatically use the latest version of dot-log
after running composer update (or composer update --no-dev, depending on the environment).

Since the DK projects require dot-log only via dot-errorhandler (not directly),
forcing them would require a patch release in all versions of dot-errorhandler
and then an update in their composer.json files that would require the latest version of dot-errorhandler that implements the latest version of dot-log.