0

My CiviCRM menu bar doesn't appear at the right place on the page and its stylesheet is not loading.

I have the same symptoms as in question Menu Problem with CiviCRM 5.13.2 but the solutions they offer there do not solve my issue.

Since the picture of the heading at http://***.be/sites/default/files/ocsr.png doesn't show up, I discovered that the files under the directory <drupal_root>/sites/default/files are not served anymore by apache when requested by the browser.

There is a .htaccess file in that directory containing:

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all
</IfModule>

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>
<IfModule mod_php7.c>
  php_flag engine off
</IfModule>

My knowledge of apache is too poor to understand if this file is the guilty, but in the logs of apache, I see entries as:

[Tue Jun 09 14:18:54.299253 2020] [authz_core:error] [pid 30658] [client 127.0.0.1:42982] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/civicrm/persist/contribute/dyn/crm-menubar.4153687684a8323812edc1dc3cdbefbd.css
[Tue Jun 09 14:38:46.732818 2020] [authz_core:error] [pid 22455] [client 127.0.0.1:43090] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/ocsr.png

that seem to be connected directly with my issue.

Since I am a newbie with CiviCRM, I don't have any clue about how to solve this.

Perhaps another useful information: I didn't have time to upgrade to the last version of Drupal 7 up to now. I don't know if the problem is coming from that delay and I don't know what is better: first solve the issue and then upgrade, or the contrary.

Improve this question

1 Answer 1

Reset to default
1

Your .htaccess file is incorrect.

It should contain the following content:


# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

The remaining lines are added ONLY for private file storage, namely these lines:

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all
</IfModule>

You should check your Drupal configuration, to ensure that you have a separate folder configured for private file storage, this should be outside your web root.

You should check your configuration against the Drupal documentation here: https://www.drupal.org/docs/7/install/setting-up-the-files-directory

Improve this answer
7
  • I will try that. Thank you. I am trying to understand why I need to have a separate folder configured for private file storage outside my web root. I don't see in drupal.org/docs/7/install/setting-up-the-files-directory anything in relation to that.
    – Pierre François
    Commented Jun 9, 2020 at 13:45
  • 1
    The entire point of your private files folder is that it's private (i.e. not in your public files path). It is used for files that are delivered via PHP/Drupal and not via the web server.
    – HomoTechsual
    Commented Jun 9, 2020 at 13:46
  • See this issue: drupal.org/project/documentation/issues/1006692
    – HomoTechsual
    Commented Jun 9, 2020 at 13:47
  • 1
    Make sure you turn off (clear!) the private files path in Drupal settings - otherwise Drupal will helpfully recreate the .htaccess it thinks should be there!
    – HomoTechsual
    Commented Jun 9, 2020 at 13:59
  • 1
    It was not true I didn't need private files. I did for the module Backup and Migrate, but thanks to the hints I found here, I could manage it to make the module save the backups in a directory outside of the Drupal tree. This is an advantage because the backups now go directly to a directory that is synchronised with the cloud.
    – Pierre François
    Commented Jun 9, 2020 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.