Upgrade to 7.24 - /tmp and .htaccess

I have followed all of the same steps as chbvl and am having the same error. I uploaded the .htaccess file as described in SA-CORE-2013-003. This resolved the error for my 2 public folder locations, however did not resolve the error with the /tmp folder.

My /tmp directory did not have a .htaccess file in it after updating the core files and I was receiving the error as above. I uploaded the same .htaccess file that I used successfully in the public folders directly into the /tmp folder. This error is still manifesting :(

Thanks in advance for any advice

Just in the process of upgrading some 6.x sites on shared hosting and I do not have access to the /tmp folder...

Hi chbvl
I had this problem too, when i move "/tmp" folder to "sites/glinboy.com/files/tmp", error disappeared!
In this folder has this .htaccess

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

May be help you :)

On many shared hosting platforms they set up a specific, per account tmp folder for you. We just went thought this with my company that has a number of sites on various shared hosting platforms. Some actually have a dedicated tmp folder for the account as previously mentioned which is a sibling of the public_html/www directory your drupal site is hosted in. So, instead of /tmp you would use ../tmp (for a path relative to drupal or the absolute path i.e., /home/user/tmp). If the host doesn't have one already set up you may want to create your own and again use the absolute path. Just make sure that the account can read into that folder (much like setting up the private files folder: https://drupal.org/documentation/modules/file "Managing file location and access")

While you can, obviously, use /tmp, as @tbm13 pointed out the actual /tmp folder is a system folder that gets flushed on reboot and/or any number of Sysadmin triggers. Not only that but /tmp is inaccessible to the public from apache, so putting an .htaccess file in there doesn't make sense on a number of levels. There should be some kind of filter that if you're using the true system /tmp directory the big scary error message doesn't show up.

Go to Configuration
-File System
Change your public file system path to "yourwebsitename.com"/sites/default/files (fixes error #1)
Change your temporary directory to home/"yourdatabasename"/tmp (fixes error #2)

*Do not include the quotation marks.

I'm a bit confused here. I got this

Public files directory	Not fully protected
See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the sites/default/files directory to help protect against arbitrary code execution.

And I read this -> https://drupal.org/SA-CORE-2013-003

I follow the instructions and the error gone. But I still want to know what's going on.

1. Is 7.24 require 2 .htaccess file ? 1 in Drupal root and the other 1 inside public files directory ? Since the Drupal root one must not remove.
2. The one inside public files directory. Should I copy the Drupal root one and then add the content to it ? Or just create a new blank .htaccess file and just add those content ?

This isn't a bug. The simple answer is to delete both .htaccess files from your /domain.com/sites/default/files folder and the /tmp folder located OUTSIDE of your drupal installation (typically at the root). Visit the file system page "(admin/settings/file-system in Drupal 6 or admin/config/media/file-system in Drupal 7)" and hit save. It will regenerate both .htaccess files for you.

The confusion comes in finding the tmp folder. Head to the root of your host and you should see the /tmp folder which is probably not located in the /home folder. People pointing to new temp files are just trying to bypass the intended tmp folder on your host.

i change /tmp to /home/[username]/tmp and it's work

I nowhere can find /tmp folder.
This "Not fully protected" message should not be visible in drupal lighttpd installations.

In the alert at https://drupal.org/SA-CORE-2013-003 states that, for D7 the .htaccess in the temp and private folders should include
deny from all

Is this in ADDITION to the content sample provided in the alert:

For Drupal 7:

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

OR

do we just add that line "deny from all" to the .htaccess files in the private and temp directories?

OK, I found the public folder .htaccess file, updated it, and the error message went away.

..but the only tmp file I find is under cgi-bin directory. Is that directory the correct one to place an .htaccess file? Do some Drupal installs not use a tmp directory?

Drupal 7.2.4
Color me confused.

Buenas,

El sitio Drupal 7.24 que me lanzaba el informe de error /tmp. He cambiado en Media/Sistema de archivos a ../tmp y error ha desaparecido, mi hosting es compartido en 1 and 1 y no tenia ningúna carpeta /tmp visible a traves de mi ftp.

Gracias un saludo a todos....

.htaccess is a very powerful file on Your server permissions should be owner - read user - read

"sites/default/ folder permissions should be set to owner - read\execute 500" and Your settings.php file to owner - read 400

and please move Your upload files folder out of sites/default to some place like sites/files

You have to hit save at admin/config/media/file-system to create Your /tmp folder plus You might have to change the name to something like tmp2 because Your server already uses tmp and will not show it.

Just delete the .htaccess file from your tmp folder, drupal will make it again and remove the message.

Make a dir named "tmp" in root with 777 permissions
Remove slash in Administration » Configuration » Media: File system » Temporary directory:
change "/tmp" into "tmp"
Automatic .htaccess is made in this tmp-dir
Error in status report dissappeared.
My Webserver is secured on a higher level to prevent unautorised access even if permission are 777.

I get the "exists but not writeable" despite owner being apache (centos) and with new .htaccess or no .htaccess. /tmp only works with no .htaccess. Thought it was SELINUX issue but that is disabled. I can make it work with a 777 but hate having it wide open despite not sharing my server. And dirs are +x too. PITA as this was just a minor upgrade from 7.20. And because not writeable, drupal won't make a .htaccess in the files dir. Got similar deal with ctools/css even though it is also owned by httpd user.

That's right it seems. Go to
Posted by royerd on November 22, 2013 at 1:29pm new

That's right it seems. Go to Configuration/File System and changing /tmp to ../tmp fixes the error in the Status update page with the .24 release.

solve my problem

I just upgraded and have the same problem. There seem to be a lot of different solutions suggested here (it's a bug...need to change configuration settings...delete files). Any consensus on what the "right" fix is?

1. For "Temporary directory": change from " /temp " (or other path) into " yourdomain.xxx/admin/config/media/file-system " to " temp " and SAVE
2. For "Public file system path": remove current .htacces file from /sites/default/files and after go to "yourdomain.xxx/admin/config/media/file-system" and press SAVE
3. For "Private file system path": remove current .htacces file from /sites/default/files/private and after go to "yourdomain.xxx/admin/config/media/file-system" and press SAVE

These simple three actions make to return smile on your face :)

Ciao
Fabrizio

Hi

I just moved servers and got the errors as above. The main difference between the two servers is that the new server has "AllowOverride None". I thought I'd try everyone's solution, but I came up with my own?

set chmod 777 for all folders under files/
in the .htaccess file, I commented out "Deny from all" so my file looks like this:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>
#Deny from all

And I solved this issue at 4am :P

Malcs

This worked for me. Thanks

I've updated to 7.26 and still have:
public files directory not fully protected
http://drupal.org/SA-CORE-2013-003

Looking this up it mentions .htaccess 19 times. I don't understand how this file functions and from the description of the security risk, I don't know how to duplicate or test for the problem. So, how do I know when I'm finished following all these instructions that everything is done properly. Then on top of all that, it says in here to ignore the error report.

I don't know what to do from here.

on the files page Home » Administration » Configuration » Media
add the complete path to the tmp directory which should be above your public_html folder this is probably something like home/user_name/tmp

../tmp worked for me. thanks.

Delete existing .htaccess files from your tmp and private folders.

Run cron to create the missing .htaccess files.

Drupal 7.32 .htaccess code that is created for tmp and private folders:

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

When will this .htaccess security issue be included in the upgrades? I have made the changes in all of the places that I can find the file and I still get the error in the configuration status page.

just double check the path to your drupal tmp folder.

change path from /tmp to tmp (if drupal is in the public_html folder)

you dont need to create the .htaccess, are already there (drupal 7.38)

I'm on Bluehost and some people have said changing the temporary folder from /tmp to ../tmp helped them. That didn't solve the issue the for me. Looking at my folder structure it seemed to me that it should be ../../tmp, so I changed it and that worked.

in /admin/config/media/file-system, put: /tmp/some-subfolder-name/
(save)
drupal creates sub folder and .htaccess in subfolder.
This setup prevents collisions with files created by another users.

by example: echo some-secret | sha1sum
c4379dc46a418d97e906c3465275091fb3dbaace

-> /tmp/c4379dc46a418d97e906c3465275091fb3dbaace