2

I use D7 with nginx and php5-fpm on Linux and get this security warning:

Public files directory Not fully protected

I see here that one needs to use this snippet in Apache's htaccess to resolve the issue:

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</files>

Just wondering what should be the nginx equivalent rule?

Update: I already have this in my nginx configs:

root   /path/to/drupal;
}

location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        if (!-f $document_root$fastcgi_script_name) {
                return 404;
        }
        try_files $uri =404;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        include fastcgi_params;
}
  • I have this strange suspicion that Drupal may test for specific rules, not for their effect. Of course I;ll be glad to know if I'm wrong. – Mołot May 30 '14 at 6:33
3

The .htaccess file won't have any effect in Nginx. You'll need to add your own rules to prevent PHP execution in the files directory.

e.g:

# Allow access to index.php only
location = /index.php {
  include fastcgi.conf;
  fastcgi_pass    127.0.0.1:9000;
}

# Any other attempt to access PHP files returns a 403.
location ~ \.php$ {
  return 403;
}

However, to fix that error message, you can actually just delete the old .htaccess file and Drupal will recreate a new correct one.

Note: the check is in system_requirements with the line

if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) { 

It only checks for that line, Drupal doesn't currently validate an actual PHP request to the relevant directory to test the handler.

  • So, was I right to guess that Drupal tests for the presence of .htaccess, not for the safety itself? :( – Mołot May 30 '14 at 7:34
  • @David I have a more complicate rule. Just not sure if that suffice. Please see the updated question. – Godo May 30 '14 at 8:04
  • 1
    @Molot, indeed. It appears the check is in system_requirements with the line if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) { It only checks for that line, Drupal could instead for example, create and request an arbitrary PHP file in the files directory to validate access. – David Thomas May 30 '14 at 8:49
  • Consider adding this to your answer - comment by @Godo shows it's confusing and people may expect that if config is OK, warning will disappear. – Mołot May 30 '14 at 8:59
  • @Molot, I was not confused about role of .htaccess in nginx. I just wanted to make sure that my nginx configs is secure enough with respect to these vulnerabilities. – Godo May 31 '14 at 4:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.