2

I'm looking through a few of my drupal sites since the recent DRUPAL-SA-CORE-2012-003 security update. I noticed that on a few of them, if I navigate to the settings.php file location through the url. The browser is just a blank page. Does this mean I can access the settings.php file? Or is this the intended functionality due to proper permissions being set?

Improve this question

1 Answer 1

Reset to default
6

This is the intended functionality - your web/server user should be able to access the file and serve it over http but the file by itself doesn't do anything unless its included in the rest of the Drupal bootstrap.

The core concern of this security notice is that there is a vulnerability if the settings.php file is writable or owned by the webserver.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.