0

I'm using Pressflow 6.38 and I'm trying to implement SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities | Drupal.org inside of /etc/httpd/conf.d/pressflow.conf configuration file, like following:

<DirectoryMatch "^/(tmp|var/www/html/current/files)">
    # Turn off all options we don't need.
    Options None
    Options +FollowSymLinks

    # Set the catch-all handler to prevent scripts from being executed.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
    <Files *>
        # Override the handler again if we're run later in the evaluation list.
        SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
    </Files>

    # If we know how to do it safely, disable the PHP engine entirely.
    <IfModule mod_php5.c>
        php_flag engine off
    </IfModule>
</DirectoryMatch>

however still getting following message in Status Report page:

Files directory Not fully protected

See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the files directory to help protect against arbitrary code execution.

My environment:

# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.8 (Santiago)
# rpm -q httpd php
httpd-2.2.15-55.el6_8.2.x86_64
php-5.3.3-48.el6_8.x86_64
# 
  • Why are you doing this in /etc/httpd/conf.d/pressflow.conf? I don't know if that is the cause of your issue, but the instructions clearly say you should add a .htaccess file inside the files dir. – marcvangend Jan 18 '17 at 22:57
  • @marcvangend, I can do .htaccess inside of files directory, but /tmp, gets wiped out, so placing .htaccess inside of /tmp won't work for me... – alexus Jan 18 '17 at 23:00
  • I see. Maybe it's possible to choose another directory for temporary storage, one that does not get wiped out? Any dir (eg. /var/drupal-tmp) will do as long as it's writable by apache and you configured the correct tmp path in Drupal. – marcvangend Jan 18 '17 at 23:25
1

quote from SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities | Drupal.org:

Additionally, the .htaccess of the temporary files directory and private files directory (if used) should include this command:

Deny from all

instead of using .htaccess inside of /tmp directory (which can be wiped), I placed following rule inside of my pressflow.conf:

<Directory "/tmp">
    Deny from all
</Directory>
  • Please provide a full answer to the question including some descriptions. Just code is not really an answer. Where did you place these files? Is it still in /etc/httpd/conf.d/pressflow.conf? Did you change tmp dir? – Neograph734 Feb 1 '17 at 23:23
  • This now answers the question. Thanks for editing :) – Neograph734 Feb 5 '17 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.