Merging develop to master in preparation for 1.2.0 release.

Author: weierophinney

CHANGELOG.md

@@ -2,10 +2,12 @@
 
 All notable changes to this project will be documented in this file, in reverse chronological order by release.
 
-## 1.1.2 - TBD
+## 1.2.0 - 2019-12-27
 
 ### Added
 
+- [#23](https://github.com/zendframework/zend-config-aggregator/pull/23) adds the ability to specify the file mode for the generated cache file, when generating a cache file. The mode can be provided via the `Zend\ConfigAggregator\ConfigAggregator::CACHE_FILEMODE` configuration option. Modes should be expressed as octal values (e.g., `0600`).
+
 - [#21](https://github.com/zendframework/zend-config-aggregator/pull/21) adds support for PHP 7.3.
 
 ### Changed

composer.json

@@ -21,7 +21,6 @@
     },
     "require-dev": {
         "malukenho/docheader": "^0.1.5",
-        "mikey179/vfsStream": "^1.6",
         "phpunit/phpunit": "^5.7.21 || ^6.3",
         "zendframework/zend-coding-standard": "~1.0.0",
         "zendframework/zend-config": "^2.6 || ^3.0",
@@ -47,8 +46,8 @@
     },
     "extra": {
         "branch-alias": {
-            "dev-master": "1.1.x-dev",
-            "dev-develop": "1.2.x-dev"
+            "dev-master": "1.2.x-dev",
+            "dev-develop": "1.3.x-dev"
         }
     },
     "scripts": {

composer.lock

@@ -44,3 +44,28 @@ providers. Because of that it is very fast, but after it is enabled, you cannot
 make any changes to configuration without clearing the cache. **Caching should
 be used only in a production environment**, and your deployment process should
 clear the cache.
+
+You can control the permissions used when creating the cache file by passing
+the [file mode](http://php.net/manual/en/function.chmod.php) in the
+`ConfigAggregator::CACHE_FILEMODE` configuration. Use this if your config
+contains sensitive information such as database passwords:
+
+```php
+use Zend\ConfigAggregator\ArrayProvider;
+use Zend\ConfigAggregator\ConfigAggregator;
+use Zend\ConfigAggregator\PhpFileProvider;
+
+$aggregator = new ConfigAggregator(
+    [
+        new ArrayProvider([
+            ConfigAggregator::ENABLE_CACHE => true,
+            ConfigAggregator::CACHE_FILEMODE => 0600 // only owner can read and write
+        ]),
+        new PhpFileProvider('*.global.php'),
+    ],
+    'data/config-cache.php'
+);
+```
+
+Note that mode is an octal value. To ensure the expected operation, you need
+to prefix the file mode with a zero (e.g. `0644`).

docs/book/caching.md

@@ -14,10 +14,15 @@
 use Zend\Stdlib\ArrayUtils\MergeReplaceKeyInterface;
 
 use function array_key_exists;
+use function chmod;
 use function class_exists;
 use function date;
+use function fclose;
 use function file_exists;
-use function file_put_contents;
+use function flock;
+use function fopen;
+use function fputs;
+use function ftruncate;
 use function get_class;
 use function gettype;
 use function is_array;
@@ -35,6 +40,8 @@ class ConfigAggregator
 {
     const ENABLE_CACHE = 'config_cache_enabled';
 
+    const CACHE_FILEMODE = 'config_cache_filemode';
+
     const CACHE_TEMPLATE = <<< 'EOT'
 <?php
 /**
@@ -253,6 +260,7 @@ private function loadConfigFromCache($cachedConfigFile)
      *
      * @param array $config
      * @param null|string $cachedConfigFile
+     * @param int $mode
      */
     private function cacheConfig(array $config, $cachedConfigFile)
     {
@@ -264,12 +272,35 @@ private function cacheConfig(array $config, $cachedConfigFile)
             return;
         }
 
-        file_put_contents($cachedConfigFile, sprintf(
+        $mode = isset($config[self::CACHE_FILEMODE]) ? $config[self::CACHE_FILEMODE] : null;
+        $tempFile = sys_get_temp_dir() . '/' . basename($cachedConfigFile) . '.tmp';
+
+        $fh = fopen($tempFile, 'c');
+        if (! $fh) {
+            return;
+        }
+        if (! flock($fh, LOCK_EX | LOCK_NB)) {
+            fclose($fh);
+            return;
+        }
+
+        if ($mode !== null) {
+            chmod($tempFile, $mode);
+        }
+
+        ftruncate($fh, 0);
+
+        fputs($fh, sprintf(
             self::CACHE_TEMPLATE,
             get_class($this),
             date('c'),
             var_export($config, true)
         ));
+
+        rename($tempFile, $cachedConfigFile);
+
+        flock($fh, LOCK_UN);
+        fclose($fh);
     }
 
     /**