By default does drupal 7's sites/default/files directory disables running of PHP files?


2 Answers 2


No - by default you have to create this directory so its up to you to make sure that the proper permissions are set to make sure its not world-writable and the executable bit is removed. Specifically, check the documentation on permissions -- you want to create this folder and set your permissions to allow the web-server user to write to the folder but not allow files to be uploaded that can be executed from here.

[root@localhost]cd /path_to_drupal_installation/sites
[root@localhost]find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
[root@localhost]for d in ./*/files
   find $d -type d -exec chmod ug=rwx,o= '{}' \;
   find $d -type f -exec chmod ug=rw,o= '{}' \;

Worst case scenario I've seen is a world-writable files folder that allows a malicious user to upload a PHP rootkit that can be executed and compromise the server.

  • can you explain this setting: ug=rwx,o= '{}' \; ? for chmod Feb 4, 2013 at 5:47
  • Drupal creates a .htaccess file in that directory w/ a SetHandler to prevent any files from being executed.
    – mpdonadio
    Feb 4, 2013 at 12:13

By default, when you site is created a .htaccess files is put in your sites/default/files directory (or wherever your public files are) and your private directory (if defined). See file_ensure_htaccess() and file_create_htaccess() for the details.

The first line of each should read

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

This is an Apache directive that resets how it handles the files in that directory, and all subdirectories. Basically, it resets the handler to a non-existent function, which prevents files from being executed. See SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations security advisory for more info. I have double checked this on a few of my servers, and this does prevent PHP from being executed.

If this line is missing, then you need to figure out what happened and how it was removed.

If this not preventing execution by Apache, then you need to look at your server configuration. It is also conceivable that PHP may be executed here from the CLI via some server exploits.

  • 3
    And if that .htaccess line is not effective then the server configuration should be reported to the Drupal Security Team drupal.org/node/101494
    – greggles
    Feb 4, 2013 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.