1

I had some Drupal installations which I merged into a multi-site installation.

When they were single installations, I created a files in the root directory and set the system permissions for the directory and its content to 755. When I ran the security review, I got no errors.

Now I set up them as multi-site; the files directory is still in the root folder, and inside there also the site1, site2, site3 directories used from the single sites. When I set the system permissions to 755 and run the security review, I get an error that about some files in my public files directory which are writeable by the server.

enter image description here

Those files have been always writeable by the server. Otherwise, CSS/JavaScript aggregation and file uploading wouldn't work.

When I set the files folder in the root directory as well as site1, site2, site3 to 555, the security review didn't report anything, but I got an error message from the Drupal status report because the public file system is not writeable from the server.

Do I need to set up the public files directory for multi-sites differently?

Improve this question
2
  • have you tried chmod -R 755 files/site1 files/site2 ... ?
    – miststudent2011
    Aug 14, 2021 at 1:53
  • Thanks for your answer. Yes I did, but I didn't read very attentive. My files folder has 555 and the site1, site2, site3 have 755 -R. And it works like expected, as it spares out the own public folder. So, if I rund a security review in the backend of site 1, I still get the error. Because It tells me in the details, that it also found the public folders of site 2 and site3, which are also 755. So it seems to throw the error because there are other directories as well, that don't belong to this installation.
    – Berry Dingle
    Aug 14, 2021 at 2:11

1 Answer 1

Reset to default
1

To answer the question: no you do not need to set up those directories differently. The webserver obviously needs write access there for storing files. If the security_review module has a problem with the dirs of the other sites then it is probably a bug in that module.

Anyhow: first click on details, maybe you find out more information there.

Then I had a look at the code, this is the method that detects the error:

https://git.drupalcode.org/project/security_review/-/blob/8.x-1.x/src/Checks/FilePermissions.php#L48

It also tries to write a file in its own module directory (which it does not communicate to the user -> not nice), so have a look into there and see if there is a file called "file_write_test[...]" or if there is a warning inside "IGNOREME.txt". If that is the case you need to remove write access to the modules directories for the webserver user (usually www-data)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.