From 3c94a43eb7d143a4ca3b3f197097c1ba205b06cc Mon Sep 17 00:00:00 2001
From: OverSu <contact@oversu.fr>
Date: Tue, 15 Sep 2026 18:40:58 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20r=C3=A9parer=20durablement=20les=20permi?=
 =?UTF-8?q?ssions=20publiques?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md          |  4 ++--
 manifest.toml      |  6 +++---
 scripts/_common.sh | 16 +++++++++++++++-
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 4461c34..c5f311b 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ Lightweight animal shelter management
 
 [![🌐 Official app website](https://img.shields.io/badge/Official_app_website-darkgreen?style=for-the-badge)](https://globinours.fr)
 [![App Demo](https://img.shields.io/badge/App_Demo-blue?style=for-the-badge)](https://demo.globinours.fr)
-[![Version: 1.0.0-rc.23~ynh1](https://img.shields.io/badge/Version-1.0.0--rc.23~ynh1-rgb(18,138,11)?style=for-the-badge)](https://ci-apps.yunohost.org/ci/apps/globinours/)
+[![Version: 1.0.0-rc.24~ynh1](https://img.shields.io/badge/Version-1.0.0--rc.24~ynh1-rgb(18,138,11)?style=for-the-badge)](https://ci-apps.yunohost.org/ci/apps/globinours/)
 
 <div align="center">
 <a href="https://apps.yunohost.org/app/globinours"><img height="100px" src="https://github.com/YunoHost/yunohost-artwork/raw/refs/heads/main/badges/neopossum-badges/badge_more_info_on_the_appstore.svg"/></a>
@@ -42,4 +42,4 @@ sudo yunohost app upgrade globinours -u https://github.com/YunoHost-Apps/globino
 
 ### 📚 App packaging documentation
 
-Please see <https://doc.yunohost.org/packaging_apps> for more information.
\ No newline at end of file
+Please see <https://doc.yunohost.org/packaging_apps> for more information.
diff --git a/manifest.toml b/manifest.toml
index af7b9f7..d2d1091 100644
--- a/manifest.toml
+++ b/manifest.toml
@@ -5,7 +5,7 @@ id = "globinours"
 name = "Globinours"
 description.en = "Lightweight animal shelter management"
 description.fr = "Gestion légère et complète pour refuges animaliers"
-version = "1.0.0-rc.23~ynh1"
+version = "1.0.0-rc.24~ynh1"
 maintainers = ["OverSu"]
 
 [upstream]
@@ -34,8 +34,8 @@ ram.runtime = "100M"
 
 [resources]
     [resources.sources.main]
-    url = "https://nnsprod.com/git/oversu/Globinours/archive/2029849f18278abd9994ef7b82af10451de93c3e.tar.gz"
-    sha256 = "af99de3939bfeeb3ef277d3b46277b382cb949e067c0dc2abe62b7fd05804ae6"
+    url = "https://nnsprod.com/git/oversu/Globinours/archive/44933575900512a5808ac9d21c2b77b9e1bbd55e.tar.gz"
+    sha256 = "f54e5856f15b58e3107508f21af61e8c355f8bf14d0ceff6e748df37634cb82c"
     in_subdir = true
     autoupdate.strategy = "latest_forgejo_commit"
     autoupdate.upstream = "https://nnsprod.com/git/oversu/Globinours"
diff --git a/scripts/_common.sh b/scripts/_common.sh
index ae0a063..66179a0 100755
--- a/scripts/_common.sh
+++ b/scripts/_common.sh
@@ -76,10 +76,16 @@ repair_and_verify_permissions() {
     chmod -R u=rwX,g=rX,o= "$install_dir"
     chmod -R u=rwX,g=,o= "$data_dir"
 
+    # Nginx doit pouvoir traverser tout le code public. Une mise à jour
+    # autonome plus ancienne a pu créer ces dossiers avec un umask strict.
+    find "$install_dir/public" -type d -exec chmod 0755 {} +
+    find "$install_dir/public" -type f -exec chmod 0644 {} +
+
     chown "$app:www-data" "$data_dir"
     chmod 0710 "$data_dir"
     chown -R "$app:www-data" "$data_dir/media"
-    chmod -R u=rwX,g=rX,o= "$data_dir/media"
+    find "$data_dir/media" -type d -exec chmod 0750 {} +
+    find "$data_dir/media" -type f -exec chmod 0640 {} +
 
     if ! ynh_exec_as_app test -r "$data_dir" || ! ynh_exec_as_app test -w "$data_dir"; then
         ynh_die --message="The Globinours system user cannot read and write its persistent data directory."
@@ -87,6 +93,14 @@ repair_and_verify_permissions() {
     if ! runuser -u www-data -- test -x "$data_dir" || ! runuser -u www-data -- test -r "$data_dir/media"; then
         ynh_die --message="Nginx cannot access the Globinours public media directory."
     fi
+    if ! runuser -u www-data -- test -r "$install_dir/public/index.php"; then
+        ynh_die --message="Nginx cannot access the Globinours public entry point."
+    fi
+    local public_media_sample
+    public_media_sample="$(find "$data_dir/media" -type f -print -quit)"
+    if [[ -n "$public_media_sample" ]] && ! runuser -u www-data -- test -r "$public_media_sample"; then
+        ynh_die --message="Nginx cannot read an existing Globinours public media file."
+    fi
     if [[ -f "$data_dir/refuge.sqlite" ]]; then
         local integrity_check
         integrity_check="$(ynh_exec_as_app sqlite3 "$data_dir/refuge.sqlite" "PRAGMA quick_check;")"