How to disable PHP files from being run in the sites/default/files directory?

Question

By default does drupal 7's sites/default/files directory disables running of PHP files?

Answer 1

No - by default you have to create this directory so its up to you to make sure that the proper permissions are set to make sure its not world-writable and the executable bit is removed. Specifically, check the documentation on permissions -- you want to create this folder and set your permissions to allow the web-server user to write to the folder but not allow files to be uploaded that can be executed from here.

[root@localhost]cd /path_to_drupal_installation/sites
[root@localhost]find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
[root@localhost]for d in ./*/files
do
   find $d -type d -exec chmod ug=rwx,o= '{}' \;
   find $d -type f -exec chmod ug=rw,o= '{}' \;
done

Worst case scenario I've seen is a world-writable files folder that allows a malicious user to upload a PHP rootkit that can be executed and compromise the server.

Answer 2

By default, when you site is created a .htaccess files is put in your sites/default/files directory (or wherever your public files are) and your private directory (if defined). See file_ensure_htaccess() and file_create_htaccess() for the details.

The first line of each should read

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

This is an Apache directive that resets how it handles the files in that directory, and all subdirectories. Basically, it resets the handler to a non-existent function, which prevents files from being executed. See SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations security advisory for more info. I have double checked this on a few of my servers, and this does prevent PHP from being executed.

If this line is missing, then you need to figure out what happened and how it was removed.

If this not preventing execution by Apache, then you need to look at your server configuration. It is also conceivable that PHP may be executed here from the CLI via some server exploits.