False Negative for Writeable .htaccess on NGINX

> After all, even if .htaccess says the right things the web server's configuration may be problematic.

Or the web server configuration may restrict it regardless of what htaccess says.

"Alternatively, maybe the module can add a test file to the files directory to see if code execution is possible."

That happens in check security_review_check_file_perms() http://cgit.drupalcode.org/security_review/tree/security_review.inc#n218 and also in security_review_check_executable_php() http://cgit.drupalcode.org/security_review/tree/security_review.inc#n614.

But yes this check could be improved to not always fail in other environments. I'm not sure I'll get to this soon so any support you can provide is welcome.

Hi guys!

I am running NGINX webserver as well and getting same warning on Security Review Check.

Is this warning dangerous for my site? What can I do to git rid of this warning?

Please let me know

Here is a patch to exclude the .htaccess check for nginx webserver.

Still works for apache, however there is a code comment on line 655 (with the patch applied); that says:

// Don't modify $result.

but in my testing I needed to modify $result

// Don't modify $result.
$result = FALSE;

So we need someone(s) to check this on nginx and someone to verify if modifying $result for the is_writable() condition is the correct course of action?

thanks,
~Geoff

ugh; #5 doesn't work; i'll try to get back to it next weekend :(

needs to be checked on nginx.

re-rolling patch so it can apply.

forward port to drupal 8
@banviktor , @coltrane
would this be better put in : https://www.drupal.org/node/2375303 ?

thanks,
~Geoff

oh; because it is trying to apply the D8 patch on the `7.x-1.x-dev` branch.

this needs patch https://www.drupal.org/files/issues/security_review-bypass-htaccess-chec... for `7.x-1.x-dev`
and patch https://www.drupal.org/files/issues/D8-security_review-false-neg-for-ngi... for the `8.x-1.x-dev` branch.

sorry,
~Geoff

setting to 8.x to test current patch then back port to 7.x

Here's a re-roll of the Drupal 8 patch from #11.

As before, it wraps that code block with:

    // Only if the webserver is Apache.
    $str = substr($_SERVER['SERVER_SOFTWARE'], 0, 6);
    if ($str == 'Apache') {

Here is a re-roll against the latest dev.

#18 works for me.

I have used patch from #18 but I got a php error:
Undefined array key "SERVER_SOFTWARE" ExecutablePhp.php:82
I fixed in this new patch.

Will this ever be included in a release? :-)

Committed in https://git.drupalcode.org/project/security_review/-/commit/282208f013dd...

I'm here because of a search for similar behavior in Drupal core's status report. First I thought I'd stumbled into just the right issue, then was scratching my head because of the closed status and note about this landing in a commit... yes, it took me a minute or three to realize I was in the issues for Security Review module, instead of drupal proper.

So the question is) does anyone have any insights as to whether any similar detection of web server has been proposed for Drupal core? Because if I'm not using Apache, I would much rather NOT have this warning about `.htaccess` always staring at me (or my clients) in the status report.

@emjayess thanks for the followup. Can you post a screenshot of the message in the status report?

Can you post a screenshot of the message in the status report?

Certainly, attached. Thanks for taking interest.. although I'm sure this is not the best place to take up the issue.

If it matters, this is a site currently running Drupal 10.4.0, which had recently been upgraded from version 8, then version 9, etc. And it is running on Pantheon; my local/dev environment also uses nginx (valet).

@emjayess that error message comes from core's system.install.

Here's an issue that I think is relevant to your goal of making it more appropriate for nginx users #3117665: Only show the error “Public files directory Not fully protected” for Apache servers

🙏🏼 Thank you for the direction @greggles!