this really drives me crazy .. BTW here is a really nice tutorial i tried - everything. believe me ... from adding users to groups, running apache as different user, chALOT -R (even chmod a+rwx), copying the original httpd.conf back, enabled UserDir, added attributes like

sudo chmod -R +a "group:_www allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" Sites

but .. i'm not an expirienced sys admin // ---

i try to use both - WebServer and User location as Document root



and actually all seems to work fine. so AllowOverride and FollowSymLinks set

except: sites/default/files/styles/

image styles do not work i get 403 for requests like


original images show up ..

maybe related to the 7.20 issue ?!

how can i properly debug this ?

  • 1
    This is more likely the issue with version 7.20 rather than the OS or server. You can add $conf['image_allow_insecure_derivatives'] = TRUE; to your settings.php to negate the effect of the update.
    – AjitS
    Feb 26, 2013 at 10:07
  • god damn. @Indrock - this did the trick .. i lost hours .. thx so much. post it as answer pls. and what about for the production site. does this have any side effects ?
    – rémy
    Feb 26, 2013 at 10:11

1 Answer 1


This is more likely to be the issue with the update of Drupal core from 7.19 to 7.20.
As per the release notes, the update was only targeted to address the Denial-of-Service attack on the sites powered by Drupal.

You can add:

$conf['image_allow_insecure_derivatives'] = TRUE;

in the settings.php, to negate the effect of the update. As per the side effects, this will remove this security fix. I wouldn't recommend you do this on production.

existing patch:

--- a/modules/image/image.module
+++ b/modules/image/image.module
@@ -993,7 +993,7 @@ function image_style_url($style_name, $path) {
// The token query is added even if the 'image_allow_insecure_derivatives'
// variable is TRUE, so that the emitted links remain valid if it is changed
// back to the default FALSE.
-  $token_query = array(IMAGE_DERIVATIVE_TOKEN =>  image_style_path_token($style_name, $path));
+  $token_query = array(IMAGE_DERIVATIVE_TOKEN => image_style_path_token($style_name, file_stream_wrapper_uri_normalize($path)));

works, and $conf can be removed !

I've answered a similar question here.

Note: I'm making this as community wiki, so that someone working on Drupal security (hopefully from the security team) or anyone who is interested could add more to it.

  • with this patch i could remove the $conf again
    – rémy
    Feb 26, 2013 at 10:42
  • @rémy Good to know that :-) You can edit this post and add that in, also it would be good if you give your feedback (regarding the patch) on the same issue on drupal.org
    – AjitS
    Feb 26, 2013 at 10:48
  • actually i commented the issue on drupal.org. but it only shows up when i'm logged in ...
    – rémy
    Feb 26, 2013 at 11:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.