This is more likely as a result of your httpd configuration. This occurs when I upload through ftp too. The source file will take on the permissions of the existing file.

cp -f in 'man cp' will remove existing files first if it cannot open them. In lieu of you having set the user or mode in the script, the system commands will operate under the user mode of the user of the script, most likely to be a user named nobody or something similar. A specific user that is essentially the httpd.

What your source file mode says is 'anyone can read me'. What 'nobody' does in your configuration, is to set the destination file permissions so only the system admin and itself have permissions on the file. This basically means that not anyone can read your httpd, only no-one can.*

Coyote