.htaccess file in the sites/default/files directory

By Steady on 21 Apr 2015 at 17:39 UTC

Hello,

Today I had a problem with some content not showing up when I copied a local drupal website onto a live server.

Amongst other things, various images and other data wouldn't show up and MD Slider was not working properly apparently.

I found out (I think) that drupal automatically creates a .htaccess file and puts it into the sites/default/files directory.

When I deleted this .htaccess file the content showed up.

Here is what the .htaccess file said:

-------
# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.

php_flag engine off

-------

After finding out more, it seems this .htaccess file is needed for security purposes (though I don't really understand how it works).

I found out that my hosting company does not allow Options +FollowSymLinks

If does allow Options +SymLinksIfOwnerMatch

So I edited the .htaccess file to the following and reuploaded it and now things seem to work ok.

-----
# Turn off all options we don't need.
Options None
Options +SymLinksIfOwnerMatch

# If we know how to do it safely, disable the PHP engine entirely.

php_flag engine off

-----

I hope by making this change I haven't screwed something else up. Comments anyone?

Also, I'm not sure in the future if drupal will ever try to recreate the .htaccess file back to the original settings.

Does anyone know anything about this or if I will need to watch out for drupal reverting back to something of its own creation.

Many thanks,

Sam

Comments

If you upgrade Drupal, then

Pablo Gosse commented 21 April 2015 at 17:55

If you upgrade Drupal, then yes you will want to make a backup of the .htaccess file in sites/default/files and replace it after you've upgraded.

As for whether you may screw something else up, that will depend on how your file system is set up. Since you're on a shared host, it probably won't be a problem and is specifically set up this way to increase security.

Also, it looks like this may be changing in Drupal 8.

https://www.drupal.org/node/1269780

Cheers,
Pablo