Hi everybody
Since I've had an attack on my website, I'm trying to follow the security_review module advices. It says that ALL my files are writable by the server (664). So I checked out and did a chmod 644 at the root. Now the cpanel file manager displays correct permissions. But when I re-run the verification in the module, it doesn't exclude the files I edited : index.php and al are still into the list.
Why ? Is this a bug (false positives) ?
Is 664 dangerous for files ? (it's the default settings for all my D7 websites at GoDaddy...)
Any idea welcome.

Comments

artatum created an issue. See original summary.

jenniferhoude’s picture

jenniferhoude commented

Experiencing the same issue.

tarik.cipix’s picture

tarik.cipix commented

Same issue in Drupal 9.3. The check is is_writable($file) and because 644 is needed the file is always writeable by the user. How can someone pass this check?

smustgrave’s picture

smustgrave commented
Version: 7.x-1.3 » 2.0.x-dev
Status: Active » Postponed (maintainer needs more info)

Tested on 9.5.x with the latest version of security_review and all is green.

Is there an additional step?

smustgrave’s picture

smustgrave commented
Status: Postponed (maintainer needs more info) » Closed (outdated)

If still experiencing the issue please reopen with additional steps thanks