7

I just upgraded to 7.25 from 7.19, and now in my Status Report I have a red X on my "Public Files" and "Temporary Files".

See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the sites/default/files directory to help protect against arbitrary code execution.

I go to the address above, but I don't have any user friendly explanation of what to do to fix this. Thanks in advance.

Update: (1/8/14)

The answer below fixes the Public files problem 100%.

It does not fix the Temp files. To fix temp files, I go to admin/config/media/file-system and change the path from /tmp to ../tmp

I will update this if this is fixed in a newer version of drupal, or if there is another fix available. I'm not sure if the ../tmp is the correct solution, but it works.

7

The easiest method is in the fine print. If you haven't edited these files, then

  • browse to admin/config/media/file-system
  • delete sites/default/files/.htaccess
  • delete wherever/your/private/files/are/.htaccess as indicated on the page you just browsed to
  • delete wherever/your/tmp/files/are/.htaccess as indicated on the page you just browsed to
  • click SAVE

This will recreate the two .htaccess files. Then visit the status report and double check things.

Otherwise, edit sites/default/files/.htaccess to be

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

and wherever/your/private/files/are/.htaccess and wherever/your/tmp/files/are/.htaccess to be

Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

Note the difference on line 1 for the private files. This is what prevents files from being browsed to from the outside world. It is also beneficial to place your private and tmp file directories outside your DOCROOT if you can, as an added precaution.

  • Did what you said and it seemed to work like a charm for the public files directory error, but the temporary files directory error still exists. Ideas? – EGHDK Jan 4 '14 at 22:28
  • 1
    @EGHDK Make sure the path to the tmp folder is valid – Clive Jan 4 '14 at 22:47
  • The path to the temp folder in admin/config/media/file-system says "/tmp". How do I know if it's valid or not? – EGHDK Jan 4 '14 at 23:01
  • 1
    @EGHDK Updated for tmp. If you delete that, too, it will get recreated. – mpdonadio Jan 5 '14 at 15:50
  • I don't have any directory "/tmp". – EGHDK Jan 5 '14 at 21:56
0

At first Create a folder "tmp" in sites/"default or whatever/files/". Then Go to Drupal admin "admin/config/file system" and update Temporary path with your tmp directory path.

That's it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.