User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog.

I changed the access of all to 555 but still get the message for the last one (ConfigAndLog). In this folder there is an .htaccess file - below. Release is 4.6.29, Drupal 7. I'm puzzled why this has happened today - 4.6.29 has been there for months. So-

  1. Why have these messages popped up now? I guess this is something timed to appear today as I also get it on a 4.7 system
  2. How do I fix the ConfigAndLog message which is still appearing?

enter image description here

  • Can you say what your web server software is (Apache, nginx, etc.) and what version? Oct 23 '17 at 16:11
  • Also, 555 means that the web server can't write new files to those directories. Oct 23 '17 at 16:13
  • Apache 2.4.25 and I reverted the 555 to 755 and now have the messages again. Also happening on a 4.7 system. Other users must be getting the same messages unless it's some local host system changes.
    – Andy Clark
    Oct 23 '17 at 17:38
  • Also, I notice that these messages can't be disabled in the 'Misc' settings & regular users get them as well as administrators, which is likely to be alarming for them.
    – Andy Clark
    Oct 23 '17 at 17:41
  • 2
    Yes, I was able to access a file in the upload folder from the website, so they are downloadable. So I will talk to the hosting company. +1 to Civi code for highlighting this problem!
    – Andy Clark
    Oct 23 '17 at 18:21

So as he why you get security warnings: because civi has found your configuration insecure, ie. you have files that shouldn't be accessible on the web but are.

As how you fix it (and get rid of the warnings), it depends on the web server you use and how it's configured.

The .htaccess rules only work for apache, and only if it's configured to read them. If you use nginx or another webserver, you will need to implement the rules denying access to these forbidden folders differently.

  • The problem was with the shared server, spent a frustrating few days convincing them that was the case - and not Civi. Eventually they fixed the problem by moving my 5 clients to a different server, while they continued to work on a fix - which was apparently an Apache problem. Plaudits to Civi team for putting those checks in the code!
    – Andy Clark
    Oct 28 '17 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.