On UNIX, PHP uses libc rename function. Thus, if you think renaming is done wrong, I think it should be submitted to libc maintainers for your system. If you use non-UNIX system, please specify which one.

Correction - there's a separate code for handling EXDEV, so it's possible the issue is in the code. I'll check it.

This is a problem when VCWD_RENAME() fails with EXDEV.

In this case, the current implementation will execute php_copy_file(), VCWD_CHMOD(), VCWD_CHOWN() in this order.

This is around the php_plain_files_rename() function in main/streams/plain_wrapper.c.


	ret = VCWD_RENAME(url_from, url_to);

	if (ret == -1) {
#ifndef PHP_WIN32
# ifdef EXDEV
		if (errno == EXDEV) {
			zend_stat_t sb;
			if (php_copy_file(url_from, url_to) == SUCCESS) {
				if (VCWD_STAT(url_from, &sb) == 0) {
#  ifndef TSRM_WIN32
					if (VCWD_CHMOD(url_to, sb.st_mode)) {
						if (errno == EPERM) {
							php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
							VCWD_UNLINK(url_from);
							return 1;
						}
						php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
						return 0;
					}
					if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
						if (errno == EPERM) {
							php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
							VCWD_UNLINK(url_from);
							return 1;
						}
						php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
						return 0;
					}
#  endif
					VCWD_UNLINK(url_from);
					return 1;
				}
			}
			php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
			return 0;
		}
# endif
#endif

I have a feeling that the best practice here would be just to have proper umask, if this is indeed a problem. Switching CHOWN/CHMOD may make sense (error handling probably will have to be adjusted... not sure).

Proposed fix in https://gist.github.com/smalyshev/4198b4573b002884ff552cffccbf050a, please verify.

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.