In my Drupal 8 site, the install.php file is accessible.
How can I restrict the access to that file?
-
I guess one way would be to amend your deployment script to remove this file from the artifact.– KevinSep 10, 2018 at 14:21
-
1Just use your web server's rewrite rules to deny access– Clive ♦Sep 10, 2018 at 14:35
Add a comment
|
2 Answers
In apache vhost:
RedirectMatch 403 "/(install|update).php"
Or in htaccess change the part on top:
# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|cron\.php|install\.php|update\.php|^(CHANGELOG|COPYRIGHT|INSTALL.*|LICENSE|MAINTAINERS|README|UPDATE).txt$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">
Please note this htaccess also protects access to cron.php, update.php, web.config and txt files like /core/CHANGELOG.txt
-
2
How come you need it gone, is it necessarily a problem? Once the site is installed you just see a message informing you the installation is done.
If you really want it gone then once your site is installed delete the install.php file from the core directory. And then do that every time you update Drupal core
-
7The install.php is not needed after the installation of Drupal. It has in the past been the cause of serious security bugs (like in 2012) and it shows for installed Drupal sites the version of your Drupal installation. So it is good to restrict access to it. Deleting it on every update is a hassle. May 14, 2019 at 8:22
-
Another alternative option would be to create a release branch in git, to be used as the basis for all releases, and remove the file there. Then any time you merge in changes from upstream, the file would get removed, prior to doing the release.– Matt V.Aug 30, 2022 at 19:10