Problem/Motivation

I run Drupal in multi-site mode.

The file permissions test doesn't allow me to take this into account: the other sites' "files" directories have to be writable but this is not something I want to appear in the review.

I can hush the "sites" directory, but that also hushes checks on site-specific modules and themes.

I can't hush "/files/" or "sites/*/files", which would be ideal.

Steps to reproduce

Run multi-site review.

Proposed resolution

Perhaps update the file permissions checks to take multi-site structures into account, so that sites/*/files can be ignored for the file permissions tests while all other sites/ child directories and files are still checked.

Alternatively, allow wildcards in the "hush directories" list, so "sites/*/files" can be entered usefully.

Issue fork security_review-3604020

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

fonant created an issue. See original summary.

smustgrave made their first commit to this issue’s fork.

smustgrave opened merge request !109

smustgrave’s picture

smustgrave commented
Version: 3.1.3 » 4.0.x-dev
Status: Active » Needs review

Can you try this.

fonant’s picture

fonant commented

That works nicely for me, where I use multi-site installations.

The new code looks to be more robust, too, in that it uses the actual directories present rather than the possibly-incomplete list in the $sites array in sites/sites.php.

Thanks!

  • smustgrave committed fbb4a1ba on 4.0.x 
    feat: #3604020 Multi-site writable files check should ignore sites/*/...
smustgrave’s picture

smustgrave commented
Status: Needs review » Fixed

Thanks for the quick review!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.