-3

I received the following error in my Drupal 8 status report:

PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the private:// directory to help protect against arbitrary code execution.

The obsolete link provided shows no guidance for Drupal 8 or 9, only 7 and prior. I already have what I believe is a strict .htaccess file I'd found elsewhere in Drupal's documentation. How can I fix this error in Drupal 8?

3

Submit the admin form @/admin/config/media/file-system will also create this .htaccess file if your folders are setup correct.

| improve this answer | |
  • I would suggest backing up then deleting the existing .htaccess in the private files folder, before doing the above. – Jaypan Jun 10 at 16:34
  • Could you elaborate what you mean by "saving the admin form?" – glenviewjeff Jun 11 at 15:51
  • Go to your-host.com/admin/config/media/file-system and submit that form. – Marcel Jun 12 at 11:20
0

Per glbr, put the following in a .htaccess file in your private files directory.

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all
</IfModule>


    # Turn off all options we don't need.
    Options -Indexes -ExecCGI -Includes -MultiViews

    # Set the catch-all handler to prevent scripts from being executed.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
    <Files *>
      # Override the handler again if we're run later in the evaluation list.
      SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
    </Files>

    # If we know how to do it safely, disable the PHP engine entirely.
    <IfModule mod_php5.c>
      php_flag engine off
    </IfModule>
    <IfModule mod_php7.c>
      php_flag engine off
    </IfModule>
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.