Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Add a missing pipe between .orig and .save extentions
Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Add a missing pipe between .orig and .save extentions
Top Drupal contributor Acquia would like to thank their partners for their contributions to Drupal.
Drupal is a registered trademark of Dries Buytaert.
Comments
Comment #2
iryston CreditAttribution: iryston as a volunteer commentedComment #3
iryston CreditAttribution: iryston as a volunteer commentedComment #4
amar.deokar CreditAttribution: amar.deokar commentedUpdated patch for drupal-7.59 .
Comment #5
cilefen CreditAttribution: cilefen at Institute for Advanced Study commentedComment #7
poker10 CreditAttribution: poker10 at ActivIT s.r.o. commentedAs mentioned in the parent D8 issue, there were new tests introduced which needed to be added also to D7.
The patch #4 looks good and does exactly the same fix to FilesMatch as #2508666: Drupal 8 .htaccess rule to prevent php file access can be easily bypassed. I have added the tests from the mentioned issue, so we should have this coverage in D7. The patch itself is unchanged (other changes in D8 issue are not currently in D7, see: #1587270: Forbid execution of PHP files in subfolders by default (except those needed by core)).
Let's check the testbot.
Comment #10
poker10 CreditAttribution: poker10 at ActivIT s.r.o. commentedHm, it seems like there is a problem with the patch or with the testbot with the new created files (probably returning 404 instead of 403). It applies locally and test passes locally. I have to look into it more closely.
Comment #11
poker10 CreditAttribution: poker10 at ActivIT s.r.o. commentedLet's try this with
'external' => TRUE(still passes locally).Comment #13
mcdruidIf we were starting from scratch I might ask whether we need to actually add all of the test files. Could we either generate them on-the-fly or just verify that we get a 403 when apache blocks the requests rather than a 404 when the file is not there?
However, this is how it was done in D8 ... and it's not wrong.
The backport looks good, the additional tests are great - without them it's nasty editing the long condition in the FilesMatch.
Thanks!
Comment #15
poker10 CreditAttribution: poker10 at ActivIT s.r.o. commentedThanks all!
Comment #16
solideogloria CreditAttribution: solideogloria commentedThe tests added for this issue include "system/test/fixtures/HtaccessTest/access_test.module" and similarly-named files, such as an info file.
After updating to Drupal 7.92, upon navigating to /admin/modules, I see an errored (unavailable) "access_test" module in the list that says "This version is not compatible with Drupal 7.x and should be replaced."
Comment #17
poker10 CreditAttribution: poker10 at ActivIT s.r.o. commentedThanks for reporting this @solideogloria! It seems like that the packaging script added some metadata to the originally empty .info file, which caused that the module is now displayed. This problem is not present in the 7.x-dev, as there are no metadata added.
I have created a follow-up issue here: #3308466: [D7] HtaccessTest - access_test module displayed in the modules list, where we can fix that (changing the status of this issue back to Fixed).