[SECURITY] AttachmentService creates directory with 777-permissions

[schams-net]

If the upload directory for attachments does not exist (yet), the AttachmentService creates a new directory automatically. It uses mode 0777, which is the widest possible access and therefore a possible security issue, depending on the server setup.

Class Mittwald\Typo3Forum\Service\AttachmentService:

[...]
//Create dir if not exists
$tca = $attachmentObj->getTCAConfig();
$path = $tca['columns']['real_filename']['config']['uploadfolder'];
if (!file_exists($path)) {
  mkdir($path, 0777, true);
}
[...]

[DavidBruchmann]

There exists an API call to set the rights according to settings, right?

[DavidBruchmann]

lowered access rights with 69bfa81 but still no API usage