1

My Drupal 7 install, has the Simplenews and Polls modules enabled, but Simplenews is set to subscribe registered members only, and Polls are only open to authenticated users. Yet, the mysite.com/pipermail and mysite.com/poll directories are accessible to anonymous view.

The mysite.com/poll directory returns a page with the Drupal theme only, and the word "Polls" in the page title, and no other data. The mysite.com/pipermail directory returns a blank page, absolutely no data.

These directories are not seen anywhere in the directory tree when I checked using File Manager in cPanel. This is a CentOS 5.10, php 5.4 install. How does one check Drupal's internal directory tree, especially to verify whether the permissions are correctly set on these unknown directories?

How do I remove these problematic directories? Also, is it possible that this flaw can be maliciously attacked, say by ftp upload means, etc.?

2
  • Did you check permissions in "admin/people/permissions" ?
    – Anil Sagar
    Commented May 2, 2014 at 4:21
  • Yes, I checked the permissions and anonymous user doesn't have access to anything in Polls. In simplenews, I've checked the subscribe option for anonymous users, because I need the 'silent' option of subscription for simplifying sending of service messages.
    – wargamer
    Commented May 2, 2014 at 5:14

1 Answer 1

0

Drupal is a Dynamic Content Management system unlike old style files and directories where you find path specific directory.. Various features are available from modules in Drupal... Modules implements menu paths using hook_menu...

For your case, module exposes permissions settings which you can set in "admin/people/permissions" for different roles... Login as admin and access above page to set access permissions..

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.