0

I am using Amazon S3 volume to store the node's attachment. I keep having the following message:

file_put_contents(public:///.htaccess): failed to open stream: "DrupalPublicStreamWrapper::stream_open" call failed file.inc:494                                                                                                   [warning]
WD security: Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your public:// directory which contains the following lines: # Turn off all options we don't need.                                 [error]
Options None
Options +FollowSymLinks.....

I tried chmod 777 on private (sites/default/files/private) public (sites/default/files) folders without any success.

Is it because amazon S3 and AWS/SDK are installed. It works weel anyway : my files are created on S3 volumes. But the message is annoying.

Any ideas ?

Thanks

Improve this question
2
  • Check your S3 settings - anything in there blocking the creation of hidden files? Do you already have an .htaccess file in there and have it set to read-only or something like that? It's likely this is just a problem with your S3 settings, or a bug in the S3 module/Drupal core
    – Clive ♦
    Commented May 3, 2015 at 10:36
  • I don't think this is the problem, since .htaccess are actually overwritten or created. I have studied the code. It seems that file_exists($htaccess_path) uses the realpath method, to check the existence of .htaccess. Since S3StreamWrapper doesn't implement realpath, it always returns false, thus failing file_exists, everytime. The comments says : "PHP's realpath() does not support stream wrappers.". The solution thus relies on S3StreamWrapper better implementation.
    – kha
    Commented May 31, 2015 at 17:12

1 Answer 1

Reset to default
0

It's all there really, it's a security warning and you can fix it by creating a .htaccess file at the root of sites/default/files. The actual content should be:

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

Additionally, the .htaccess of the temporary files directory and private files directory (if used) should include this command:

Deny from all

Read more in this security advisory.

Improve this answer
4
  • S3 doesn't use Apache and doesn't process .htaccess files, so doing this would be pointless. This would be perfectly fine advice for people using Apache with the relevant overrides enabled, though
    – Clive ♦
    Commented May 3, 2015 at 10:34
  • As the poster mainly wanted to silence the warning without changing the current behavior (file are created correctly) I figured having the rights files should be enough. It will remove the warnings/errors in admin/reports/status too. Still, I wouldn't accept my answer as it's really not a clean solution to the problem at hand but a workaround at most.
    – Ben
    Commented May 4, 2015 at 7:17
  • Thanks for your precious answers.I'll try these leads and report on the topic later today. Now, I have read the File source code, and it seems that even if you don't use public or private but s3, it stills checks the folders configuration to see if it can or can not create files there, including .htaccess. So it may be a simple standard access rights configuration issue.
    – kha
    Commented May 8, 2015 at 1:24
  • I still can't find a solution for this issue. I strictly followed the access rights recommandation, and its works fine locally. Issue only appears when storing docs on S3. .htaccess is created on S3 bucket file are upload correctly to bucket I still get the warning message Any idea ?
    – kha
    Commented May 30, 2015 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.