PGPRO-2784: Windows installer does not clear permissive ACL entries

VictorSpirin · VictorSpirin · commit fcac59568cd7 · 2019-10-22T14:20:06.000+03:00
diff --git a/build/build64.cmd b/build/build64.cmd
@@ -1,9 +1,11 @@
 SET ARCH=X64
 SET SDK=MSVC2013
-SET PG_MAJOR_VERSION=10
-SET PG_PATCH_VERSION=4
+SET PG_MAJOR_VERSION=12
+SET PG_PATCH_VERSION=0
 SET PRODUCT_NAME=PostgreSQL
 rem SET PRODUCT_NAME=PostgreSQL 1C
 rem SET ONE_C=YES
 rem SET PGURL=http://repo.postgrespro.ru/1c-10-beta/src/postgrespro-1c-10.3.tar.bz2
+SET PERL5LIB=.
+SET MSBFLAGS=/m
 call run.cmd %1
diff --git a/nsis/postgresql.nsi b/nsis/postgresql.nsi
@@ -933,6 +933,17 @@ Section $(componentServer) sec1
   ${endif}
   FileClose $LogFile ;Closes the filled file
 
+
+  AccessControl::DisableFileInheritance "$DATA_DIR"
+  AccessControl::RevokeOnFile "$DATA_DIR" "(BU)" "GenericWrite + GenericRead"
+  AccessControl::RevokeOnFile "$DATA_DIR" "(AU)" "GenericWrite + GenericRead"
+  AccessControl::RevokeOnFile "$DATA_DIR" "(DU)" "GenericWrite + GenericRead"
+
+  push "$INSTDIR"
+  call createAccessForFolder
+
+
+
 SectionEnd
 
 Section $(componentDeveloper) secDev
@@ -2509,3 +2520,20 @@ Function un.onInit
   ${endif}
 
 FunctionEnd
+
+Function createAccessForFolder
+         pop $0
+         AccessControl::DisableFileInheritance "$0"
+         AccessControl::RevokeOnFile "$0" "(BU)" "GenericWrite"
+         AccessControl::RevokeOnFile "$0" "(AU)" "GenericWrite"
+         AccessControl::RevokeOnFile "$0" "(DU)" "GenericWrite"
+         AccessControl::GrantOnFile "$0" "(BU)" "GenericRead + GenericExecute"
+         ${if} ${AtLeastWin8}
+               ;ALL_APP_PACKAGES (S-1-15-2-1)
+               AccessControl::GrantOnFile "$0" "(S-1-15-2-1)" "GenericRead + GenericExecute"
+               ;The SID for "ALL RESTRICTED APPLICATION PACKAGES" is S-1-15-2-2
+               AccessControl::GrantOnFile "$0" "(S-1-15-2-2)" "GenericRead + GenericExecute"
+         ${endif}
+
+FunctionEnd
+
