Problem/Motivation

Drupal says "The directory sites/default is not protected from modifications and poses a security risk. You must change the directory's permissions to be non-writable" when the permissions for the directory are r-xr-xr-x (555), that is, no account is allowed to write to the directory. Screenshot attached.

Paradoxically, when the site directory's permissions are changed to 755, the error goes away, and the status report says everything is fine, so Drupal thinks a directory which is writable is non-writable, and it thinks that a directory which is non-writable is writable.

Steps to reproduce

  1. chmod 555 sites/default
  2. load /admin/reports/status

Proposed resolution

Modify Drupal so that it can correctly detect the file system permissions for the site directory.

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

File system permissions detection now correctly recognizes when the site directory is non-writable.

CommentFileSizeAuthor
bogus-writable-message.png243.4 KBbkline

Comments

bkline created an issue. See original summary.

cilefen’s picture

cilefen commented
Title: Drupal claims site directory is writable when it's not » The requirements test for writable directories reports r-xr-xr-x (555) as writable
Component: base system » system.module
xjm’s picture

xjm
she/her
Primary language English
commented
Version: 10.2.x-dev » 11.x-dev

Interesting! Moving to the main development branch, where it would need to be fixed first.

mstrelan’s picture

mstrelan commented
Status: Active » Postponed (maintainer needs more info)

I'm not able to reproduce this, is anyone else able to? I note drupal_verify_install_file has not changed much since 2006 other than code style and #2950851: invalid conf file warnings when skip_permissions_hardening is on.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

quietone’s picture

quietone commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)
Issue tags: +Bug Smash Initiative

I tested on main, and like @mstrelan, I am not able to reproduce this problem.

Therefore, closing as cannot reproduce.

Thanks

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.