So there are the following two posts (among others) that say 755 is okay for the sites/default/files directory:
I took over a site that was hacked (due to missing a security update and improper Drupal/server configurations), whereby the hacker setup a generic form to download files (.js, .php, etc.) to the default files folder, then presumably they'd be able to execute them by setting up another page on the site that actually loads the file.
They did this by commandeering a site with admin privileges. And while I could not find an actual file they downloaded to the files directory, they did wind up altering the company's homepage with a "You've been hacked" message and an image of a country's flag.
Now to my questions:
- Why have 755 on sites/default/files directory (and sub-directories) instead of 744? Isn't the files folder by definition for user files and system caching files? To flip the question around, is there any legitimate reason to allow "x" for the group/other users?
- Is the new default .htaccess file (shown below for reference) that gets written to sites/default/files "secure enough" that even if a user hacks the front end or database, they can't really cause much havoc? If not, is there something that can be done to prevent all executables from running within /sites/default/files?
Here's the .htaccess file written by Drupal:
# Turn off all options we don't need. Options None Options +FollowSymLinks # Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006 <Files *> # Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003 </Files> # If we know how to do it safely, disable the PHP engine entirely. <IfModule mod_php5.c> php_flag engine off </IfModule>