Server 500 Error prevents images from displaying

I'm not quite clear on where the whole process is failing. Could you go down this list and tell me which ones fail?

1. Visit node/add/[whatever] and upload an image.
2. Thumbnail shows up next to the uploaded image on the node edit form.
3. Check that the file physically exists at sites/default/files/[name of file.ext] on the server
4. When viewing the node the image is displayed with the correct src at http://example.com/sites/default/files/[name of file.ext]?123456790
5. The file is visible when you visit it through the browser at http://example.com/sites/default/files/[name of file.ext]

From your description above, it sounds like you're saying that #3 and #4 pass, but #5 does not (in which case I'd be stumped). But I'm not sure I understood correctly.

The ?1234567890 is just a timestamp that is added to the URL to keep the browser from caching the image if a new image is uploaded and shouldn't affect the normal path to the image.

I'm not sure how the file could be successfully uploaded (#3), but you're not able to view it through the browser (#5). Are you sure you're looking at the right URL? Do you have any special .htaccess files in your files directory? It's possible that it would be preventing the files from being access (or settings by your web host might cause similar problems).

Have you tried using the core upload.module, just to see if you can view the files uploaded through it?

Hmm, .htaccess files are definitely seeming to be culprit here now, or server configuration.

First I'd recommend replacing your .htaccess file in the root of your Drupal installation with a fresh copy from core:
http://cvs.drupal.org/viewvc.py/drupal/drupal/.htaccess?revision=1.90.2....

Make sure you don't have any customizations that you want to keep in that file.

Next, look for .htaccess files in your sites/default/files directory. Drupal adds one for you automatically as a security measure. Feel free to make a copy of it (sites/default/files/.htaccess), then delete it off the server. It'll be recreated for you automatically. If there are any other .htaccess files that you can find, try removing them (make copies first).

If there aren't .htaccess files anywhere else, it's likely server configuration and you should check with your hosting company.

I discovered that this occurs unless I have the line "Options +FollowSymLinks" commented out.

Oh interesting! I've never heard of this problem before (it gives me serious worries about your host), but it offers up a valuable starting point. The .htaccess file automatically created by Drupal in your files directory also contains this line. If it's causing 500 errors on normal site, it's probably also causing the same error in the files directory.

Open up the sites/default/files/.htaccess file, and comment out the FollowSymLinks line. Deleting the file won't work since Drupal will automatically recreate the file (like I said above).

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
#Options +FollowSymLinks

Hmm, how curious. :-)

I really don't know what's going on with your server. I've never seen either of these problems. For the time being, you could try commenting out all three lines from the sites/default/files/.htaccess file. However, this opens your site up to some security holes to clever hackers if you allow any outside users to upload files (read: super dangerous). If possible, I'd suggest finding a new web host at the soonest opportunity (I love my host a2hosting).

The security release was this one here: http://drupal.org/node/65409

Basically what this exploit allowed was you could upload a file like script.php.psd. Since Apache doesn't know how to handle .psd files, it would fall back to .php. Meaning if you allowed the upload of PSD files, a user could upload a PHP script to the site, execute it, and wreck havoc. The .htaccess file prevents PHP (or any other scripts) from running within the files directory.

However if you're not allowing any other users to upload files you're at no risk. Drupal also puts in place other preventions to keep this exact example from occurring (it renames any files with double-extensions, and specifically prevents some extensions like php, cgi, asp, etc). Commenting out these lines are definitely not something I'd recommend on a site of any scale.

Renaming issue for posterity. Please open a new issue for any other questions. Glad we could get it working. :-)

Hi

Got the exact same problem with exactly the same solution.

Changed 'sites/default/files/.htaccess' from

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks

to

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
#Options None
#Options +FollowSymLinks

and now it works. I don't know if it makes any difference but the host has "safe mode" on.

By the way I had to change $Config['UserFilesPath'] in 'sites/all/modules/fckeditor/fckeditor/editor/filemanager/connectors/php/config.php' from '' to '/sites/default/files/userfiles/' in order to see the files in FCKEditor. This applied even for files I had uploaded with FTP.

Thanks so much this thread helped a lot,
I changed my files .htaccess file (s noted by nostromo. ) to

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
#Options None
#Options +FollowSymLinks

now images show up. I was getting a 403 error.

also for the record, I am hosting with media temple on the grid server.

Same Error

The .htacces in 'site/default/files/'
contains:

<Directory /home/path/to/site>
   RewriteEngine on
   RewriteBase /
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
</Directory>

what should I add or remove, to fix it?
Would the site be secure if I just deleted it?

Update...
Apparently the above .htaccess file is the one that goes in 'site/default'.

I re-added the original distribution .htaccess to 'site/default/files', and the result is success!

I had exactly the same problem - no images at all!

Discovered the same solution - the .htaccess file in sites/default/files.

Had to comment out in the same way:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
#Options None
#Options +FollowSymLinks

Full saga:

http://drupal.org/node/1121774

I had the same problem, and an earlier problem with the main .htaccess in the root folder. Commenting out the 'Options' lines resolved.

The reason this threw an error was my host's Apache config: AllowOverride Options is not enabled on their Apache configuration.

I don't know what impact it has to remove Options +FollowSymLinks. Is this just Drupal being safe, in case that's not enabled in the main Apache config?

My host is fasthosts, btw.

Be sure you have the following modules installed on your server:

- php5-gd ( sudo apt-get install php5-gd )
- php5-imagick ( sudo apt-get install php5-imagick )