fix: correct permissions and target in File and UploadedFile move()

Author: gr8man

system/Files/File.php

@@ -170,7 +170,7 @@ public function move(string $targetPath, ?string $name = null, bool $overwrite =
             throw FileException::forUnableToMove($this->getBasename(), $targetPath, strip_tags($error['message']));
         }
 
-        @chmod($destination, 0777 & ~umask());
+        @chmod($destination, 0666 & ~umask());
 
         return new self($destination);
     }

system/HTTP/Files/UploadedFile.php

@@ -159,7 +159,7 @@ public function move(string $targetPath, ?string $name = null, bool $overwrite =
             throw HTTPException::forMoveFailed(basename($this->path), $targetPath, $message);
         }
 
-        @chmod($targetPath, 0777 & ~umask());
+        @chmod($destination, 0666 & ~umask());
 
         // Success, so store our new information
         $this->path = $targetPath;

tests/system/Files/FileWithVfsTest.php

@@ -150,4 +150,13 @@ public function testMoveReturnsNewInstance(): void
         $this->assertInstanceOf(File::class, $file);
         $this->assertSame($destination . '/apple.php', $file->getPathname());
     }
+
+    public function testMovePermissions(): void
+    {
+        $destination = $this->start . 'baker';
+        $this->file->move($destination);
+
+        $expectedPerms = 0666 & ~umask();
+        $this->assertSame($expectedPerms, $this->root->getChild('baker/apple.php')->getPermissions());
+    }
 }

tests/system/HTTP/Files/FileMovingTest.php

@@ -98,6 +98,7 @@ public function testMove(): void
 
         $this->assertTrue($this->root->hasChild('destination/' . $finalFilename . '.txt'));
         $this->assertTrue($this->root->hasChild('destination/' . $finalFilename . '_1.txt'));
+        $this->assertSame(0666 & ~umask(), $this->root->getChild('destination/' . $finalFilename . '.txt')->getPermissions());
     }
 
     public function testMoveSanitizesClientNameByDefault(): void