Upgrading from 7.22 to 7.28, htaccess file in /tmp [duplicate]

Question

I get this error :

My .htaccess file in that directory looks like this now (I copied it from the url):

# Turn off all options we don't need.
Deny All
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

I still get said error. Why?

Answer 1

Make sure your file system settings are set to /tmp or tmp, then...

In the tmp folder, select the htaccess and delete it from your FTP, then refresh your site cache.

Drupal will replace the missing .htaccess automatically.

Answer 2

First, your Deny directive has a syntax error. It should read

Deny from all

If this doesn't fix your problem, make sure your temporary directory is set correctly in admin/config/media/file-system. If you still have the problem I would suspect an Apache configuration problem.

Answer 3

As far as https://drupal.org/SA-CORE-2013-003; It suggests,

To fix the code execution prevention vulnerability on existing Apache installations also requires changes to your site's .htaccess files in the files directories. Until you do this, your site's status report page at admin/reports/status will display error messages about the problem. Please note that if you are using a different web server such as Nginx the .htaccess files have no effect and you need to configure PHP execution protection yourself in the respective server configuration files.

To fix this issue, you must edit or replace the old .htaccess files manually. Copies of the .htaccess files are found in the site's files directory and temporary files directory, and (for Drupal 7 only) the separate private files directory if your site is configured to use one. To find the location of these directories, consult the error messages at admin/reports/status, or visit the file system configuration page at admin/settings/file-system (Drupal 6) or admin/config/media/file-system (Drupal 7). Note that you should only make changes to the .htaccess files that are found in the directories specified on that page. Do not change the top-level .htaccess file (at the root of your Drupal installation).

Go onto your server, navigate to each directory, and replace or create the .htaccess file in this directory with the contents described below. Alternatively, you can remove the .htaccess file from each directory using SFTP or SSH and then visit the file system configuration page (admin/settings/file-system in Drupal 6 or admin/config/media/file-system in Drupal 7) and click the save button to have Drupal create the file automatically.

The recommended .htaccess file contents are as follows.

For Drupal 6:

Turn off all options we don't need. Options None Options +FollowSymLinks

Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

If we know how to do it safely, disable the PHP engine entirely. php_flag engine off

PHP 4, Apache 1. php_flag engine off

PHP 4, Apache 2. php_flag engine off For Drupal 7:

Turn off all options we don't need. Options None Options +FollowSymLinks

Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

If we know how to do it safely, disable the PHP engine entirely. php_flag engine off Additionally,

the .htaccess of the temporary files directory and private files directory (if used) should include this command:

Deny from all