diff --git a/core/modules/system/src/Tests/System/SitesDirectoryHardeningTest.php b/core/modules/system/src/Tests/System/SitesDirectoryHardeningTest.php index 8c9a5f2..d8f2c58 100644 --- a/core/modules/system/src/Tests/System/SitesDirectoryHardeningTest.php +++ b/core/modules/system/src/Tests/System/SitesDirectoryHardeningTest.php @@ -62,9 +62,9 @@ function testSitesDirectoryHardeningConfig() { // Disable permissions enforcement. $settings = Settings::getAll(); - $settings['sites_permissions'] = TRUE; + $settings['skip_permissions_hardening'] = TRUE; new Settings($settings); - $this->assertTrue(Settings::get('sites_permissions'), 'Able to set to true'); + $this->assertTrue(Settings::get('skip_permissions_hardening'), 'Able to set to true'); // Intentionally make our sites directory and settings.php writable. chmod($site_path, 0744); @@ -79,7 +79,7 @@ function testSitesDirectoryHardeningConfig() { // Re-enable permissions enforcement. $settings = Settings::getAll(); - $settings['sites_permissions'] = FALSE; + $settings['skip_permissions_hardening'] = FALSE; new Settings($settings); // Manually trigger the requirements check. diff --git a/core/modules/system/system.install b/core/modules/system/system.install index df8968b..14a70c3 100644 --- a/core/modules/system/system.install +++ b/core/modules/system/system.install @@ -368,7 +368,7 @@ function system_requirements($phase) { // Allow system administrators to ignore permissions hardening for the site // directory. This allows additional files in the site directory to be // updated when they are managed in a version control system. - if (Settings::get('sites_permissions')) { + if (Settings::get('skip_permissions_hardening')) { $message = t('Protection disabled'); $severity = REQUIREMENT_WARNING; } @@ -379,7 +379,7 @@ function system_requirements($phase) { } foreach (array('settings.php', 'settings.local.php', 'services.yml') as $conf_file) { $full_path = $site_path . '/' . $conf_file; - if (file_exists($full_path) && (Settings::get('sites_permissions') || !drupal_verify_install_file($full_path, FILE_EXIST|FILE_READABLE|FILE_NOT_WRITABLE))) { + if (file_exists($full_path) && (Settings::get('skip_permissions_hardening') || !drupal_verify_install_file($full_path, FILE_EXIST|FILE_READABLE|FILE_NOT_WRITABLE))) { $conf_errors[] = t("The file %file is not protected from modifications and poses a security risk. You must change the file's permissions to be non-writable.", array('%file' => $full_path)); } } diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php index f7b26f3..1a6d148 100644 --- a/sites/default/default.settings.php +++ b/sites/default/default.settings.php @@ -552,19 +552,7 @@ * Note: This setting does not apply to installation and update pages. */ # $settings['maintenance_theme'] = 'bartik'; -/** - * Override file system permissions hardening. - * - * The system module will periodically check the permissions of your site's - * site directory to ensure that it is not writable by the website user. For - * sites that are managed with a version control system, this can cause problems - * when files in that directory (such as a "settings.inc" containing additional - * configuration) are updated, because the user pulling in the changes won't - * have permissions to modify files in the directory. - * - * Remove the leading hash sign to disable permissions hardening. - */ -# $settings['sites_permissions'] = TRUE; + /** * PHP settings: * diff --git a/sites/example.settings.local.php b/sites/example.settings.local.php index a5d50f2..0626967 100644 --- a/sites/example.settings.local.php +++ b/sites/example.settings.local.php @@ -90,3 +90,17 @@ * using these parameters in a request to rebuild.php. */ $settings['rebuild_access'] = TRUE; + +/** + * Skip file system permissions hardening. + * + * The system module will periodically check the permissions of your site's + * site directory to ensure that it is not writable by the website user. For + * sites that are managed with a version control system, this can cause problems + * when files in that directory (such as a "settings.inc" containing additional + * configuration) are updated, because the user pulling in the changes won't + * have permissions to modify files in the directory. + * + * Remove the leading hash sign to disable permissions hardening. + */ +$settings['skip_permissions_hardening'] = TRUE;