2

The content of the top-level server directory is publicly available by the web, e.g. files like example.com/readme.txt are readable.
Is it normal? How can i disable this?

(apache, ubuntu 12.04)

Improve this question
0

2 Answers 2

Reset to default
2

It is not normal. Test if your .htaccess file is there, and looks the same as one in the fresh copy downloaded from Drupal.org - if they are different, use the stock one.

If your .htaccess file is identical to the stock one, you need to make your Apache to respect this part:

# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(|~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
</FilesMatch>

How exactly you should do it would be off topic here, but may be asked on Ask Ubuntu.

Note that while default .htaccess protect most extensions you don't want served, it does not hide txt files you explicitly asked for. So just add that extension to the list, as you can see, it's pretty straightforward.

This will block txt files from all directories, except sites/*/files, that have separate .htaccess files, with their own rules of access (since 7.22). If you don't want to serve core's readme.txt, then you probably don't want to serve modules' readme.txt too.

Improve this answer
6
  • That's what seemed to me. The .htaccess is here, though, and the private directory for example is properly protected,
    – Dalmaz
    Jan 24, 2014 at 8:31
  • 1
    @Dalmaz that makes it Apache or Ubuntu question. From Drupal's point of view, everything is all right.
    – Mołot
    Jan 24, 2014 at 8:32
  • 2
    Don't add the txt ext. to that list, it isn't what you want! You want to hide only the txt files on the root directory, not all txt files.
    – rreiss
    Jan 24, 2014 at 10:07
  • 1
    @Rotem since 7.22 sites/sitename/files directories has separate .htaccess fiels with their own rules of allowance and denial. And I don't see how anyone would want to serve txt files like /sites/all/modules/modulename/readme.txt - they are exactly as bad as readme for core.
    – Mołot
    Jan 24, 2014 at 10:18
  • 1
    By the way I found a fine explanation of the regex in question at stackoverflow.com/questions/18676012/…
    – Dalmaz
    Jan 24, 2014 at 21:10
4

As I understood - you want to hide the txt files on the root direcroty (e.g. Changlog.txt) from prying eyes, therefore you can search Drupal.org for that question (its there..), and you'll see 3 types of solutions:
1. Leave those file as they are ( I don't like that option) 2. Just delete those files 3. Hide them using the site's .htaccess (My favorite option)

Improve this answer
2
  • So is it the default behaviour? I'm afraid my server is misonfigured.
    – Dalmaz
    Jan 24, 2014 at 11:55
  • 2
    Read this - drupal.org/node/79018 , it is Drupal 6 issue, but has a lot of comments related to D7
    – rreiss
    Jan 24, 2014 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.