Need more documentation around temporary directory htaccess, htaccess for files directory

Drupal: 6.29
MySQL database : 5.5.32
PHP: 5.3.27
Web server: Apache

Temporary files directory Not fully protected
See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the /tmp directory to help protect against arbitrary code execution.

I've added a .htaccess file to my existing files and to files/tmp but the warning doesn't goes away.

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>
# PHP 4, Apache 1.
<IfModule mod_php4.c>
  php_flag engine off
</IfModule>
# PHP 4, Apache 2.
<IfModule sapi_apache2.c>
  php_flag engine off
</IfModule>

Tried a fresh install on a test site and Drupal makes a .htaccess file in the files directory but not in the files/tmp directory but still the warning stays.

What is wrong?

Been fighting with this one for over two hours, too. But got it solved.
The tmp directory file needs an extra line, like it says in the (poor) documentation. "Deny from all" should be added, presumably as first line of the file.
It looks like the file is created automatically when you (re)define the tmp location through the Drupal UI.

Even a new install (on a test site) gives the same warning with the automatic created .htaccess file .

Added the line and it doesn't work.
In my /tmp I have the following .htaccess

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>
# PHP 4, Apache 1.
<IfModule mod_php4.c>
  php_flag engine off
</IfModule>
# PHP 4, Apache 2.
<IfModule sapi_apache2.c>
  php_flag engine off
</IfModule>

For us newbies this is a bear!! Will this be fixed in the next update? And if I don't do anything what will happen?

Closing as a duplicate (well, partial duplicate) of #2141065: Incorrect warnings about insecure .htaccess file in /tmp directory from SA-CORE-2013-003; see that issue for details.

But in short, to answer your original question, @joelcollinsdc, as long as the temporary files directory is outside the webroot (for example, in /tmp) the .htaccess file is unnecessary and you don't have to worry about it. In that case, it will indeed get wiped occasionally (when the /tmp directory gets wiped) but it's also OK since the .htaccess file isn't needed in that case anyway. As a bit of a hack for this situation, the Status Report page will try to create the .htaccess file again every time you visit the Status Report (to prevent misleading error messages from appearing there).

@Niek_Kloots, it sounds like your issue is that you are creating the .htaccess file in "files/tmp" but that doesn't match the actual location ("/tmp") that your Drupal site is configured to use for temporary files. Again, see the above issue for more details.

subscribe

@David_Rothstein Thank you that worked.
previous I had in
File system path: files and
Temporary directory: /tmp

I changed /tmp in files/tmp and the warning disappeared.
Strange that previous /tmp was enough for the system to know the where the /tmp was.

As described in #2141065: Incorrect warnings about insecure .htaccess file in /tmp directory from SA-CORE-2013-003 switching the configuration to use files/tmp (in the public web root) is not recommended. It is better to leave it at /tmp.