my D7 admin/reports/status page reports
Private files directory Not fully protected
See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the /srv/www/D7_private_files directory to help protect against arbitrary code execution.
ErrorPublic files directory Not fully protected
See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the sites/default/files directory to help protect against arbitrary code execution.
Reading @
SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities
To my D7 site's Apache 2.4 config I've added
Options None
Options +FollowSymLinks
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
<DirectoryMatch "/srv/www/D7_private_files" >
Require all denied
</DirectoryMatch>
<DirectoryMatch "sites/default/files" >
Require all denied
</DirectoryMatch>
cleared all caches & restarted the server, but status still reports the "Not fully protected" 'errors'.
What config do I need to add/change in my Apache config to clear/fix these errors, and their cause?
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | bug.png | 95.71 KB | starlightE |
Comments
Comment #1
starlightE commentedThe solution is a permissions adjustment.
The root cause is that in order for Drupal to get access to the private directory, the directory permissions must have the httpd user as the group and mod settings must be 770 or 775 or 77x. i like 770 myself, Apache must have read,write,execute permission because Apache (or any user) cannot CD into any directory unless that directory allows execution. Thats why when directories are setup with mkdir, the norm is with 755 permissions. without execute permissions apparently Drupal core (or whatever is checking) cannot chdir into the private directory so the bad message (below) never goes away
I am running Drupal 8.4.3 on Fedora 25, with root access. I tried EVERYTHING in all the documentation suggested for this issue
and nothing would remove the "Private Files Directory Not Fully Protected" from the status page. I made the fix using sudo from a nonroot
account. I dropped the suggested .htaccess file into the directory and voila, all is good and I can go take a nap!
Once I changed the permissions on the private directory to 770 with apache as the group (or whatever you have in httpd.conf)
and refreshed the page, that nasty message immediately changed to the sweet message "NULL" -- in other words, the message disappeared! :-)
by the way, i have the directory set outside the DocumentRoot defined by Apache. I hope this helps....