Return to Answer

Fixed link (had to add some words to get over the 6 chars change)

Source Link

edit approved Jun 27, 2013 at 16:32

By default, when you site is created a .htaccess files is put in your sites/default/files directory (or wherever your public files are) and your private directory (if defined). See file_ensure_htaccess() and file_create_htaccess() for the details.

The first line of each should read

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

This is an Apache directive that resets how it handles the files in that directory, and all subdirectories. Basically, it resets the handler to a non-existent function, which prevents files from being executed. See SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations security advisory for more info. I have double checked this on a few of my servers, and this does prevent PHP from being executed.

If this line is missing, then you need to figure out what happened and how it was removed.

If this not preventing execution by Apache, then you need to look at your server configuration. It is also conceivable that PHP may be executed here from the CLI via some server exploits.

The first line of each should read

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

This is an Apache directive that resets how it handles the files in that directory, and all subdirectories. Basically, it resets the handler to a non-existent function, which prevents files from being executed. See SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations for more info. I have double checked this on a few of my servers, and this does prevent PHP from being executed.

If this line is missing, then you need to figure out what happened and how it was removed.

If this not preventing execution by Apache, then you need to look at your server configuration. It is also conceivable that PHP may be executed here from the CLI via some server exploits.

The first line of each should read

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

This is an Apache directive that resets how it handles the files in that directory, and all subdirectories. Basically, it resets the handler to a non-existent function, which prevents files from being executed. See SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations security advisory for more info. I have double checked this on a few of my servers, and this does prevent PHP from being executed.

If this line is missing, then you need to figure out what happened and how it was removed.

If this not preventing execution by Apache, then you need to look at your server configuration. It is also conceivable that PHP may be executed here from the CLI via some server exploits.

Source Link

created Feb 4, 2013 at 14:31

mpdonadio ♦

38.1k
8
89
142

The first line of each should read

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

This is an Apache directive that resets how it handles the files in that directory, and all subdirectories. Basically, it resets the handler to a non-existent function, which prevents files from being executed. See SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations for more info. I have double checked this on a few of my servers, and this does prevent PHP from being executed.

If this line is missing, then you need to figure out what happened and how it was removed.

If this not preventing execution by Apache, then you need to look at your server configuration. It is also conceivable that PHP may be executed here from the CLI via some server exploits.