Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem
-
Directly after installing Drupal, uid 1 is greeted with an error message pointing to the Status report page, which says:
Temporary files directory
Not fully protected
See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the C:\Windows\Temp directory to help protect against arbitrary code execution.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | drupal8.htaccess-save.2.patch | 2.02 KB | sun |
Comments
Comment #1
larowlanYeah same story on Linux, when outside docroot. After release was about 50% of traffic on security mailing list.
Comment #2
sunHumm... The current code does not appear to work at all.
The .htaccess file in my public files directory was created in January 2014, but still contains
Attached patch fixes at least the requirements error for the .htaccess file in the temporary files directory.
The problem is caused by Drupal itself:
file_save_htaccess()has already performed:Comment #3
sunI actually believe we need to rethink the .htaccess file futzing entirely.
Instead of the
$force_overwriteflag, we should add a comment like this to each .htaccess file that is created by Drupal:Comment #4
larowlanThe issue with Linux if you're using the os temp Dir is that Drupal has no business adding .htaccess files to directories outside the web root, there isn't a way for those to be executed from the browser via a URL like there is for the files directory
Comment #6
sunre #4: The same applies for Windows, too... — I don't have access to the discussion of the security issue.
I wonder whether there were/are any particular reasons for writing an .htaccess file to scheme file directory paths that are outside of the web root?
Wouldn't the following be sufficient?
(same for private://)
Comment #7
larowlanAdded you to the security thread, it's a long read.
I think that might suffice but didn't cover when Drupal is installed in a sub directory and the temp path is directly above it. But there are heaps of other configurations as well where the temp path might be outside Drupal but still accessible but again nearly all of those would surely be bad server config
Comment #8
jhedstromWould the fix suggested in #6 be sufficient here?
Comment #9
OnkelTem commentedSame issues here on D8 RC2.
I wonder why `.htaccess`was not created at installation by default?
Comment #14
David_Rothstein commentedLinking to a related issue, although not necessarily the same thing.
Comment #15
christopher james francis rodgers commented[Accidental double-posting. See next comment. ~Chris]
Comment #16
christopher james francis rodgers commented[Complete One-step Solution for newbies who stumble upon this page because of this ongoing problem, which existed back in D7]
You may want to undo any other changes you have made while trying to resolve this issue.
This worked for my new Drupal 8.4.2 site at an online shared webhost, and also has worked for years with Drupal 7.
The Total One-step Solution:
Go to your Drupal 8, or Drupal 7, configuration page:
admin/config/media/file-system
Change the field 'Temporary directory' from...
/tmp...to...
~/tmpClick the page-bottom button "Save configuration".
Note: I have also read elsewhere on drupal.org that in addition to
~/tmp, the following may also work-- I do not think it matters what path and folder-name you use, so long as it is not the one which is currently giving you problems:../tmptmp/tmpdirtmpdirComment #26
luke.stewart commentedIt's been a while since this was touched but a quick check of the relevant code suggests nothing much has probably changed.
In the interim a new issue has been lodged and there is some activity there. Given this I think we can close this issue as a duplicate as while it is older there is more in train over on #2906490
Comment #27
luke.stewart commented