1

I ran into an issue (When using fpm, it is not clear how to make image styles work ) which I traced back to the use of Drupal_Security_Do_Not_Remove_See_SA_2006_006 in sites/default/files/.htaccess.

In order to continue debugging I would need a more solid understanding of what exactly "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006" does in that file, because when I comment it out, my issue is resolved.

Is there code somewhere which "Handles" files? If so where? I have searched Drupal and cannot find any actual logic behind this.

Improve this question
3
  • drupal.org/forum/newsletters/…
    – sonfd
    Apr 1, 2022 at 0:12
  • From reading that, it appears that this is to prevent scripts in your files directory, where files are uploaded to, cannot be executed. Without this, a hacker could potentially upload a script to that directory and access it.
    – Jaypan
    Apr 1, 2022 at 5:51
  • 1
    This is a question about Apache. (What happens when the handler set for a directory doesn't exist?) Drupal doesn't have any Drupal_Security_Do_Not_Remove_See_SA_2006_006.* file, as you already found out, which means that handler doesn't exist.
    – apaderno ♦
    Apr 1, 2022 at 8:03

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.