Public and temporary files error in my "Status Report"

Question

I just upgraded to 7.25 from 7.19, and now in my Status Report I have a red X on my "Public Files" and "Temporary Files".

See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the sites/default/files directory to help protect against arbitrary code execution.

I go to the address above, but I don't have any user friendly explanation of what to do to fix this. Thanks in advance.

Update: (1/8/14)

The answer below fixes the Public files problem 100%.

It does not fix the Temp files. To fix temp files, I go to admin/config/media/file-system and change the path from /tmp to ../tmp

I will update this if this is fixed in a newer version of drupal, or if there is another fix available. I'm not sure if the ../tmp is the correct solution, but it works.

Answer 1

The easiest method is in the fine print. If you haven't edited these files, then

• browse to admin/config/media/file-system
• delete sites/default/files/.htaccess
• delete wherever/your/private/files/are/.htaccess as indicated on the page you just browsed to
• delete wherever/your/tmp/files/are/.htaccess as indicated on the page you just browsed to
• click SAVE

This will recreate the two .htaccess files. Then visit the status report and double check things.

Otherwise, edit sites/default/files/.htaccess to be

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

and wherever/your/private/files/are/.htaccess and wherever/your/tmp/files/are/.htaccess to be

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

Note the difference on line 1 for the private files. This is what prevents files from being browsed to from the outside world. It is also beneficial to place your private and tmp file directories outside your DOCROOT if you can, as an added precaution.

Answer 2

At first Create a folder "tmp" in sites/"default or whatever/files/". Then Go to Drupal admin "admin/config/file system" and update Temporary path with your tmp directory path.

That's it.