0

This question already has an answer here:

I get this error :

enter image description here

My .htaccess file in that directory looks like this now (I copied it from the url):

# Turn off all options we don't need.
Deny All
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

I still get said error. Why?

marked as duplicate by Mołot, Free Radical, mpdonadio May 14 '14 at 22:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

Make sure your file system settings are set to /tmp or tmp, then...

In the tmp folder, select the htaccess and delete it from your FTP, then refresh your site cache.

Drupal will replace the missing .htaccess automatically.

0

First, your Deny directive has a syntax error. It should read

Deny from all

If this doesn't fix your problem, make sure your temporary directory is set correctly in admin/config/media/file-system. If you still have the problem I would suspect an Apache configuration problem.

-2

As far as https://drupal.org/SA-CORE-2013-003; It suggests,

To fix the code execution prevention vulnerability on existing Apache installations also requires changes to your site's .htaccess files in the files directories. Until you do this, your site's status report page at admin/reports/status will display error messages about the problem. Please note that if you are using a different web server such as Nginx the .htaccess files have no effect and you need to configure PHP execution protection yourself in the respective server configuration files.

To fix this issue, you must edit or replace the old .htaccess files manually. Copies of the .htaccess files are found in the site's files directory and temporary files directory, and (for Drupal 7 only) the separate private files directory if your site is configured to use one. To find the location of these directories, consult the error messages at admin/reports/status, or visit the file system configuration page at admin/settings/file-system (Drupal 6) or admin/config/media/file-system (Drupal 7). Note that you should only make changes to the .htaccess files that are found in the directories specified on that page. Do not change the top-level .htaccess file (at the root of your Drupal installation).

Go onto your server, navigate to each directory, and replace or create the .htaccess file in this directory with the contents described below. Alternatively, you can remove the .htaccess file from each directory using SFTP or SSH and then visit the file system configuration page (admin/settings/file-system in Drupal 6 or admin/config/media/file-system in Drupal 7) and click the save button to have Drupal create the file automatically.

The recommended .htaccess file contents are as follows.

For Drupal 6:

Turn off all options we don't need. Options None Options +FollowSymLinks

Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

If we know how to do it safely, disable the PHP engine entirely. php_flag engine off

PHP 4, Apache 1. php_flag engine off

PHP 4, Apache 2. php_flag engine off For Drupal 7:

Turn off all options we don't need. Options None Options +FollowSymLinks

Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

If we know how to do it safely, disable the PHP engine entirely. php_flag engine off Additionally,

the .htaccess of the temporary files directory and private files directory (if used) should include this command:

Deny from all

  • So any idea how I can get rid of it? I already ran /.update.php – Evaldas Raisutis May 13 '14 at 18:35
  • 1
    @DigitalFire, you've got no idea what you're talking about. This is misinformation. – Free Radical May 13 '14 at 19:18
  • @FreeRadical My original suggestion was based off this post. drupal.org/node/2140629 – Digital fire May 13 '14 at 21:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.