Getting Security warning everytime I log into civicrm that my log directory is downloadable. I checked and it is completely viewable on my browser. I realize that there is a solution for nginx enviroments however I am running my site on pantheon and do not have access to any nginx configs. Is there something I can do civi-side to fix this?
Pantheon does not support .htaccess files nor custom location directives, which are the common approaches to protecting those files from access on Apache / Nginx.
However, moving your CiviCRM file directories from
sites/default/private/civicrm should resolve this, because Pantheon protects that location out of the box.
See Drupal.org #2195947 - Security warning from Civi re exposed "files" directory for how this is addressed in CiviCRM StarterKit.
You will need to end up with something like this in your civicrm.settings.php, the linked issue above gives the required context needed to ensure
$pantheon_conf contains appropriate values.
global $civicrm_setting; $civicrm_setting['Directory Preferences']['uploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/upload/'; $civicrm_setting['Directory Preferences']['customFileUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/custom/'; $civicrm_setting['Directory Preferences']['imageUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/persist/contribute/'; $civicrm_setting['Directory Preferences']['extensionsDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/code/sites/all/extensions/'; $civicrm_setting['URL Preferences']['extensionsURL'] = $base_url . '/sites/all/extensions';
See also the relevant CiviCRM security advisory, CIVI-SA-2014-001 Risk of information disclosure. Moving the restricted files outside the webroot entirely would be the ideal solution if/when CiviCRM supports that.
Thanks @Chris Burgess! I went with your recommendation and pushed the edited civi settings file up to pantheon but still got the same warnings. I then went into administer>system settings>directory and noticed that the settings where still pointing to the public files. I then sftp'd into sites/default/private and manually created the same directory names that civi was using in the public files. Then in the GUI I added private/ after files/ for all the upload directories.
Since the code didn't do the trick I reverted to prior settings and everything still works. I'm not getting the security warnings anymore.
UPDATE: After @Chris Burgess comment below, we went ahead and added his code mentioned in his answer in civicrm.settings.php. We had to replace the last line with : $civicrm_setting['URL Preferences']['userFrameworkResourceURL'] = $base_url . '/sites/all/extensions';
Everything looks good now
Pantheon allows you to protect (a limited number of) webpaths, using a pantheon.yml file.
protected_web_paths: - /example_directory
It is, in effect, a nginx deny.