Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)

Question

I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not able to fix it.

Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/custom/) should not be downloadable.

Read more about this warning

Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/upload/) should not be downloadable.

Read more about this warning

I have tried this on my nginx configuration file.

    root /home/drupal7;

    location ~ /sites/example.org/files/civicrm/(custom|upload) {
        deny all;
        return 404;
    }

Answer 1

Your proposed solution in your nginx config looks about right; here's a tested & working example:

location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) {
    deny all;
}

Here are some things you could check.

1. Have you reloaded nginx since making the config change?

2. Pick a file in files/civicrm/custom/ and try to access it in a browser.

   • If you can, the nginx config needs fixing.
   • If you can't, the warning is spurious; it would be good to investigate why. Check your nginx access logs for the test requests that Civi makes to check access.

3. Is another location block in your nginx config taking precedence over this one? You can check this by temporarily enabling debug-level logging for the relevant virtual host, e.g.

   error_log /path/to/log debug;

(Note that nginx needs to have been built with --with-debug .) This will produce very verbose logging, so only enable it briefly while testing: enable debug, access a file under files/civicrm/custom/ , disable debug, then look through your error log for the request. From this, you should be able to see which location block matched the request.

You should also deny access to ConfigAndLog/ and templates_c/ as in the config above.

See checkUploadsAreNotAccessible.