Securing folder in Custom Module for Drupal 6

Question

I wrote a custom module, which logs errors to an external text file. The files are kept in

/sites/all/modules/custom/my_module/logging/

The problem is, if the user know the name of the file, they can go directly to it. For example, if they go to:

http://localhost/MySite/web/sites/all/modules/custom/my_module/logging/

The will get a forbidden error. But, if they know the name of the document and go to:

http://localhost/MySite/web/sites/all/modules/custom/my_module/logging/myFile.txt

the full file is rendered to the browser. Is there a way to prevent this? Ideally, I would like to show the files to certain users but at the very least prevent it all together.

Answer 1

The real problem here is that the files shouldn't be written into the module directory. There are actually two reasons for this (one of which you've run into):

1. it becomes harder to upgrade the module codebase (i.e. because you have to worry about accidentally overwriting the log files)
2. anybody can access the files (i.e. this question!)

You mention that you'd like certain users to be able to access the log files. You have a few options:

1. Move the logfile directory outside of the webroot

   In other words, if your Drupal site resides at e.g. /home/foo/public_html, create a new directory at /home/foo/module_logs and write the files there instead.

   This prevents Apache (or whatever webserver) from delivering the file, but lets it remain accessible to PHP which access it directly from the file system.

2. Deny access to the files in their current location

   Assuming you're using Apache, you can use a .htaccess file in the directory where the files are written to deny access to them. Some variant on this should work:

   <FilesMatch "\.txt$">
   Deny from all
   </FilesMatch> 
   

   As in #1, your module will still be able to read the files (this is what also happens in Drupal's default .htaccess file--you can see that it denies access to e.g. .info files, but Drupal can obviously still read them...)

3. Turn on private file downloads

   I don't really suggest this to solve your problem, as it's kind of the 'nuclear option' and would affect every file controlled by Drupal. You can find this under the file system settings in the administration area.

   In options 1 and 2, you will have to alter your module. In this one you probably wouldn't need to, but you might need to modify everything else in your site :-)

4. Use file system permissions

   Again assuming this is running on an Apache webserver, you could also have your module set the o ('other users') bit of the log files' permissions to zero using PHP's chmod() function.

   In other words, your files are probably being created with permissions 644, so you might try creating them with permissions set to 640 instead. Your PHP scripts (i.e. Drupal) should be unaffected unless you change the first or second digit.

   In addition to being Apache-specific, this item also might work differently than expected if your Apache-PHP setup is different than I'm expecting.