0

User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog.

I changed the access of all to 555 but still get the message for the last one (ConfigAndLog). In this folder there is an .htaccess file - below. Release is 4.6.29, Drupal 7. I'm puzzled why this has happened today - 4.6.29 has been there for months. So-

  1. Why have these messages popped up now? I guess this is something timed to appear today as I also get it on a 4.7 system
  2. How do I fix the ConfigAndLog message which is still appearing?

enter image description here

Improve this question
6
  • Can you say what your web server software is (Apache, nginx, etc.) and what version?
    – Jon G - Megaphone Tech
    Commented Oct 23, 2017 at 16:11
  • Also, 555 means that the web server can't write new files to those directories.
    – Jon G - Megaphone Tech
    Commented Oct 23, 2017 at 16:13
  • Apache 2.4.25 and I reverted the 555 to 755 and now have the messages again. Also happening on a 4.7 system. Other users must be getting the same messages unless it's some local host system changes.
    – Andy Clark
    Commented Oct 23, 2017 at 17:38
  • Also, I notice that these messages can't be disabled in the 'Misc' settings & regular users get them as well as administrators, which is likely to be alarming for them.
    – Andy Clark
    Commented Oct 23, 2017 at 17:41
  • 2
    Yes, I was able to access a file in the upload folder from the website, so they are downloadable. So I will talk to the hosting company. +1 to Civi code for highlighting this problem!
    – Andy Clark
    Commented Oct 23, 2017 at 18:21

1 Answer 1

Reset to default
1

So as he why you get security warnings: because civi has found your configuration insecure, ie. you have files that shouldn't be accessible on the web but are.

As how you fix it (and get rid of the warnings), it depends on the web server you use and how it's configured.

The .htaccess rules only work for apache, and only if it's configured to read them. If you use nginx or another webserver, you will need to implement the rules denying access to these forbidden folders differently.

Improve this answer
1
  • The problem was with the shared server, spent a frustrating few days convincing them that was the case - and not Civi. Eventually they fixed the problem by moving my 5 clients to a different server, while they continued to work on a fix - which was apparently an Apache problem. Plaudits to Civi team for putting those checks in the code!
    – Andy Clark
    Commented Oct 28, 2017 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.