1

I run a Drupal Commons site and I'd like to set it up on a new server. When I set this particular site up, I need to replace Drupal's base .htaccess file so that it runs in my server environment.

However, this answer states that the .htaccess is present in two places:

The .htaccess files (which are present in at least two places) should have the permission 644.

Is this true? If so, where is the second one? Is it the one in sites/default?

Improve this question

1 Answer 1

Reset to default
5

There are actually 1+n .htaccess files in any given Drupal directory, where n is the number of working sites:

  1. In the Drupal root
  2. One for each site's files directory

The contents of the files directory .htaccess file is the following:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks

This was done as part of a security update to Drupal 4.6.x and 4.7.x, and has been there ever since. The relevant security advisory, SA-2006-006, explains why:

Certain -- alas, typical -- configurations of Apache allows execution of carefully named arbitrary scripts in the files directory. Drupal now will attempt to automatically create a .htaccess file in your "files" directory to protect you. This line references SA_2006_006 to lead Apache administrators to this announcement.

Thus it's not advised that you replace or remove that file.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.