Hi,
My Drupal 8 status report is giving me warnings:
The first relates to protection of configuration files:
Configuration files Not protected
Protection disabled
The file sites/default/settings.php is not protected from modifications and poses a security risk. You must change the file's permissions to be non-writable.
The file sites/default/settings.local.php is not protected from modifications and poses a security risk. You must change the file's permissions to be non-writable.
The file sites/default/services.yml is not protected from modifications and poses a security risk. You must change the file's permissions to be non-writable.
However, permissions are as shown.
-r--r--r-- 1 root root 6761 Mar 27 12:57 services.yml
-r--r--r-- 1 root root 3754 Mar 23 09:16 settings.local.php
-r--r--r-- 1 www-data root 30819 Mar 23 08:59 settings.php
I've restarted apache and rebuilt permissions & cleared cache but the warning stays even though the files are not writable.
There is also a warning:
Rebuild access Enabled
The rebuild_access setting is enabled in settings.php. It is recommended to have this setting disabled unless you are performing a rebuild.
However there is no rebuild_access setting in setting.php.
Any help appreciated.
Comments
Hardening setting?
https://www.drupal.org/node/2820620
SOLVED
Thanks,
That was it.
I had to comment
$settings['skip_permissions_hardening'] = TRUE
and
$settings['rebuild_access'] = TRUE
in settings.local.php
weird!