3

Getting Security warning everytime I log into civicrm that my log directory is downloadable. I checked and it is completely viewable on my browser. I realize that there is a solution for nginx enviroments however I am running my site on pantheon and do not have access to any nginx configs. Is there something I can do civi-side to fix this?

Improve this question

3 Answers 3

Reset to default
5

Pantheon does not support .htaccess files nor custom location directives, which are the common approaches to protecting those files from access on Apache / Nginx.

However, moving your CiviCRM file directories from sites/default/files/civicrm to sites/default/private/civicrm should resolve this, because Pantheon protects that location out of the box.

See Drupal.org #2195947 - Security warning from Civi re exposed "files" directory for how this is addressed in CiviCRM StarterKit.

You will need to end up with something like this in your civicrm.settings.php, the linked issue above gives the required context needed to ensure $pantheon_conf contains appropriate values.

  global $civicrm_setting;
  $civicrm_setting['Directory Preferences']['uploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/upload/';
  $civicrm_setting['Directory Preferences']['customFileUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/custom/';
  $civicrm_setting['Directory Preferences']['imageUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/persist/contribute/';
  $civicrm_setting['Directory Preferences']['extensionsDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/code/sites/all/extensions/';
  $civicrm_setting['URL Preferences']['extensionsURL'] = $base_url . '/sites/all/extensions';

See also the relevant CiviCRM security advisory, CIVI-SA-2014-001 Risk of information disclosure. Moving the restricted files outside the webroot entirely would be the ideal solution if/when CiviCRM supports that.

Improve this answer
1
  • The message recently resurfaced even though I did apply those changes to civicrm.settings.php and moved my civicrm files directory from files/civicrm to files/private/civicrm. I took a peak into my files directory and found that the civicrm directory was recreated in files/ in addition to the one in files/private. The one that was recreated in files/ contains only a template_c directory and configandlog directory. I looked at the civicrm.settings and found some paths for template_c and changed those to private/ but nothing regarding config and log... any ideas?
    – Yossi
    Commented Aug 19, 2015 at 0:51
2

Thanks @Chris Burgess! I went with your recommendation and pushed the edited civi settings file up to pantheon but still got the same warnings. I then went into administer>system settings>directory and noticed that the settings where still pointing to the public files. I then sftp'd into sites/default/private and manually created the same directory names that civi was using in the public files. Then in the GUI I added private/ after files/ for all the upload directories. enter image description here

Since the code didn't do the trick I reverted to prior settings and everything still works. I'm not getting the security warnings anymore.

UPDATE: After @Chris Burgess comment below, we went ahead and added his code mentioned in his answer in civicrm.settings.php. We had to replace the last line with : $civicrm_setting['URL Preferences']['userFrameworkResourceURL'] = $base_url . '/sites/all/extensions';

Everything looks good now

Improve this answer
3
  • You should review What is required to run CiviCRM on Pantheon? which better explains the reason for setting those paths in civicrm.settings.php - basically, at some point Pantheon is likely to move your /srv/bindings/2c6caa...path, and those settings now stored in your DB will stop working. That's why we load the binding root from $pantheon_conf['pantheon_binding'] instead.
    – Chris Burgess
    Commented Aug 7, 2015 at 1:39
  • To have the settings change from my answer work, make sure you're matching the context etc so that $pantheon_conf actually exists and contains your binding root. See linked issue for full details.
    – Chris Burgess
    Commented Aug 7, 2015 at 2:18
  • Thank @Chris. We pasted your code and everything good. All I did was change the last line to this : $civicrm_setting['URL Preferences']['userFrameworkResourceURL'] = $base_url . '/sites/all/extensions';
    – Yossi
    Commented Aug 7, 2015 at 17:23
2

Pantheon allows you to protect (a limited number of) webpaths, using a pantheon.yml file.

protected_web_paths:
  - /example_directory

(https://pantheon.io/docs/pantheon-yml/#protected-web-paths)

It is, in effect, a nginx deny.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.