Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

This question already has an answer here:

this really drives me crazy .. BTW here is a really nice tutorial i tried - everything. believe me ... from adding users to groups, running apache as different user, chALOT -R (even chmod a+rwx), copying the original httpd.conf back, enabled UserDir, added attributes like

sudo chmod -R +a "group:_www allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" Sites

but .. i'm not an expirienced sys admin // ---

i try to use both - WebServer and User location as Document root

setup
/etc/apache2/http.conf

setup
/etc/apache2/users/me.conf

and actually all seems to work fine. so AllowOverride and FollowSymLinks set

except: sites/default/files/styles/

image styles do not work i get 403 for requests like

sites/default/files/styles/fancy/public/animage.jpg

original images show up ..

maybe related to the 7.20 issue ?!

how can i properly debug this ?

share|improve this question

marked as duplicate by kiamlaluno Feb 26 '13 at 11:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
This is more likely the issue with version 7.20 rather than the OS or server. You can add $conf['image_allow_insecure_derivatives'] = TRUE; to your settings.php to negate the effect of the update. –  AjitS Feb 26 '13 at 10:07
    
god damn. @Indrock - this did the trick .. i lost hours .. thx so much. post it as answer pls. and what about for the production site. does this have any side effects ? –  rémy Feb 26 '13 at 10:11
add comment

1 Answer 1

up vote 3 down vote accepted

This is more likely to be the issue with the update of Drupal core from 7.19 to 7.20.
As per the release notes, the update was only targeted to address the Denial-of-Service attack on the sites powered by Drupal.

You can add:

$conf['image_allow_insecure_derivatives'] = TRUE;

in the settings.php, to negate the effect of the update. As per the side effects, this will remove this security fix. I wouldn't recommend you do this on production.

existing patch:

--- a/modules/image/image.module
+++ b/modules/image/image.module
@@ -993,7 +993,7 @@ function image_style_url($style_name, $path) {
// The token query is added even if the 'image_allow_insecure_derivatives'
// variable is TRUE, so that the emitted links remain valid if it is changed
// back to the default FALSE.
-  $token_query = array(IMAGE_DERIVATIVE_TOKEN =>  image_style_path_token($style_name, $path));
+  $token_query = array(IMAGE_DERIVATIVE_TOKEN => image_style_path_token($style_name, file_stream_wrapper_uri_normalize($path)));

works, and $conf can be removed !

I've answered a similar question here.

Note: I'm making this as community wiki, so that someone working on Drupal security (hopefully from the security team) or anyone who is interested could add more to it.

share|improve this answer
    
with this patch i could remove the $conf again –  rémy Feb 26 '13 at 10:42
    
@rémy Good to know that :-) You can edit this post and add that in, also it would be good if you give your feedback (regarding the patch) on the same issue on drupal.org –  AjitS Feb 26 '13 at 10:48
    
actually i commented the issue on drupal.org. but it only shows up when i'm logged in ... –  rémy Feb 26 '13 at 11:08
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.