I'm getting a problem with image styles being created. The files are there but the styles are not getting created.

The message log is: Access Denied to sites/default/files/styles/fotogallery-thumb/public/modules/image/sample.png

CommentFileSizeAuthor
#12 access-denied-image-styles.png77.3 KBviresh shah
#6 installation.jpg118.63 KBtiko
1.png32.05 KBgiupenni

Comments

tiko’s picture

tiko commented

This problem can occur due to lack of styles directory permission. What OS are you using?

giupenni’s picture

giupenni commented

My hosting plan has Linux. In the same provider I have other Drupal installations and I have not problems.

The permissions are:
775 -> sites/default/files
755 - > sites/default/files/styles

The .htaccess in sites/default/files is:

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

I also tried to comment Options None and Options +FollowSymLinks without success.

I noticed the problem affect all uploaded files.

tiko’s picture

tiko commented

Just change the permission for sites/default/files/styles directory and its subdirs to 775.

giupenni’s picture

giupenni commented

Changed but I have not solved.

In other installations the permission for sites/default/files/styles is 755 and I have not problems.

By the way, sites/default/files/styles is automatically generated by Drupal with 755 permission.

giupenni’s picture

giupenni commented

In sites/default/files/.htaccess I have change Options +FollowSymLinks to Options +SymLinksIfOwnerMatch and I solve it.

Is safe or could lead to a security issue?

tiko’s picture

tiko commented
StatusFileSize
new installation.jpg118.63 KB

I try to install in Debian and it can't create "files" directory because "default" dir's permissions are 755.
If you change "default" dir's permissions to 777 the installation goes without any problems then you should change it to 775.
Meanwhile, I don't recieve any .htaccess file in default/files.

j420n’s picture

j420n commented

Change the ownership of the files directory to be owned by the user which is used by the web server, This may fix your issue.
On Debian it may be something like;
mkdir sites/default/files
chown -R www-data:www-data sites/default/files

You should not have permissions set to 777 on the files directory if it is a production server.

giupenni’s picture

giupenni commented

The problem was to change Options +FollowSymLinks to Options +SymLinksIfOwnerMatch in sites/default/files/.htaccess.

The .htaccess in sites/default/files must be present. https://www.drupal.org/SA-CORE-2013-003

So now my question is:
is safe to use Options +SymLinksIfOwnerMatch or could lead to a security issue?
I think safe but I'm not sure.

j420n’s picture

j420n commented

I came across this https://www.drupal.org/node/1269780

giupenni’s picture

giupenni commented

Bingo.
This is the problem.
Many hosts for safety reasons forbid +FollowSymLinks.
Can be a good idea bring the patch at Drupal 7 ?

giupenni’s picture

giupenni commented
Component: image system » base system
viresh shah’s picture

viresh shah commented
StatusFileSize
new access-denied-image-styles.png77.3 KB

I'm also getting same error. I'm using Windows 8.1 with XAAMP. I tried following:

1. Checked permission for “styles” folder and make sure it’s writable. At end I just gave “everyone” permission to /sites/default/files folder but didn’t work.
2. Tweaked .htaccess file in /files folder as per#5 but doesn't work. Even I commented out those lines:

# Turn off all options we don't need.
#Options None
#Options +FollowSymLinks

Please check attached file how it looks when you access image styles. Any help would be highly appreciated. Thanks!

viresh shah’s picture

viresh shah commented

Updates to #12

It turned out to ImageMagick configuration issue. I had to install imagemagick PHP extension for windows and we've to set a field path to convert library at 'admin/config/media/image-toolkit'.

scor’s picture

scor commented

Looks like you may be hitting the fix that was introduced in Drupal 7.20 for protect agains DoS attacks via image derivatives: https://www.drupal.org/drupal-7.20-release-notes

oemb29’s picture

oemb29 commented

To solve this issue you must to create a folder outside of website directory and put 755 permission and change it at admin/config/media/file-system

caspervoogt’s picture

caspervoogt commented

@oemb29, on admin/config/media/file-system it says "A local file system path where public files will be stored. This directory must exist and be writable by Drupal. This directory must be relative to the Drupal installation directory and be accessible over the web.".

Version: 7.34 » 7.x-dev

Core issues are now filed against the dev versions where changes will be made. Document the specific release you are using in your issue comment. More information about choosing a version.

Status: Active » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.