0

As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, theme, modules etc. But these directory contains some .yml or .install files e.g drupal/web/core/modules/user/user.install which gets downloaded automatically when someone visits my site example.com/core/modules/user/user.install .

So is it okay to expose those files to public ? and what steps can be taken to avoid it ? I checked some popular sites they also expose those files. So bit confused.

Note: Drupal default .htaccess may take care of these thing for Apache server only but what about other servers like nginx ? However I think Drupal is hard coded to be used with Apache server only.

  • This is neither enabled by default, nore necessary. Drupal ships with a well-designed ~/web/.htaccess that "whitelists" static assets in /coreetc, don't fix things that aren't broken – Hudri Nov 22 '18 at 16:59
  • 1
    @Hudri please don't vote down if you have no appropriate answer for the question. I am using NGINX and it doesn't obey .htaccess files. – SkyRar Nov 22 '18 at 17:02
  • Voting isn't based on whether or not you know the answer to a question. But either way, @Hudri's comment does happen to implicitly answer the question. Drupal core sees fit to use a whitelist for the /core folder, so you can assume you should do the same in whatever web server you're using – Clive Nov 22 '18 at 17:07
  • Sorry, but not changing my downvote. Yes .htaccess does not work for nginx, but the very first google hit on "drupal 8 nginx" answers your question. – Hudri Nov 22 '18 at 17:07
  • 1
    @Clive Thanks. But I am not totally agree with Hudri . Because the question clearly states that if any security issue is there if I expose those files ? – SkyRar Nov 22 '18 at 17:14
1

No.

The web server (e.g. via apache's directive) needs to be able to read (not write) the index.php file (and occasionally others such as update.php), and also static files such as .css/.js, pdfs and images.

The php interpreter is not limited by directives and so most other files required by php do not have to be visible.

As Hudri said, leave the .htaccess files as they are, configure the server to notice them (AllowOverrides) and refer to an appropriate guide, such as: https://www.drupal.org/docs/develop/local-server-setup/linux-development-environments/installing-php-mysql-and-apache-under

  • Thanks. Can you please tell me what may be security issue if those files are exposed ? I see some popular sites also expose those files. So I am bit confused that upto what extent security risks are there ? I know it is a broad question. But you can give an example please. – SkyRar Nov 22 '18 at 17:23
  • SkyRar - Drupal 8, configured properly out of the box is pretty secure. Follow the guides until you know more about the topic. – rivimey Nov 22 '18 at 17:28
  • 2
    What’s with the “upvote this”, “don’t downvote this” on this one?! Votes should only be applied when the beholder thinks a post warrants them, not just because a question/answer/comment happens to have been posted. Asking for/against them is considered noise and not something we need to have taking up valuable brain space in the comments :) – Clive Nov 22 '18 at 17:31
  • 1
    @SkyRar a specific example would be arbitrary and I suspect not particularly helpful to you. Suffice to say you’d be exposing some of the code that runs the website, and/or its configuration. Having that information is likely to help a potential attacker more than it would hinder them, therefore it’s prudent not to allow that to happen. – Clive Nov 22 '18 at 17:35
  • When I visit "core/modules/user/user.install" on any of my sites I get a 403 from Apache. – Kevin Nov 22 '18 at 17:39
0

We shouldn't expose those files. So I added below directives inside nginx.conf.

# Protect files and directories from prying eyes.
    location ~ \.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.$
            return 403;
    }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.