1

Can you please give your suggestions to help to solve the following system status warning?

(1) The CiviCRM debug log should not be downloadable.

(2) Files in the data directory (/var/www/html/wordpress/wp-content/uploads/civicrm/upload/) should not be downloadable.

(3) Files in the data directory (/var/www/html/wordpress/wp-content/uploads/civicrm/custom/) should not be downloadable.

(4) Outdated tokens in use - Please review your contribution_invoice_receipt message template and remove references to the token {$display_name} as it has been replaced by {contact.display_name}.

For (1),(2),and (3), can we solve the problem by setting the directory using ckmod 700? Many Thanks!

Improve this question

1 Answer 1

Reset to default
4

For {$display_name}, this was changed in the template two years ago. Can you revert the template to the default to get the updated version? Of if you have customizations, you'll want to apply them to the updated template.

For the access issues, these should be covered by .htaccess files in those directories. Can you check that those files are present and if so, what the contents are?

The .htaccess files should contain:

<Files "*">
# OpenLiteSpeed 1.4.38+
  <IfModule !authz_core_module>
    RewriteRule .* - [F,L]
  </IfModule>

# Apache 2.2
  <IfModule !authz_core_module>
    Order allow,deny
    Deny from all
  </IfModule>

# Apache 2.4+
  <IfModule authz_core_module>
    Require all denied
  </IfModule>
</Files>

The debug log is the ConfigAndLog folder in the same place as the upload and custom folders.

Improve this answer
12
  • Thanks for the reply, I have checked we don't have .htaccess file in those directories.
    – Learn CiviCRM
    Commented Aug 20, 2023 at 18:48
  • You can add the .htaccess files with the details I added above.
    – Lars SG
    Commented Aug 20, 2023 at 19:10
  • Is the webserver apache? If it's nginx then .htaccess won't work and you'll need to configure it differently.
    – Demerit
    Commented Aug 21, 2023 at 22:23
  • Thanks Lars SG and Demerit. Our server is apach2 not nginx, the .htaccess is under /var/www/html/wordpress, is it if we include the above, the warning should be solved? our testing machine is WSL which is using nginx, can you let ss know how to solve it? Thanks to both of you.
    – Learn CiviCRM
    Commented Aug 22, 2023 at 15:21
  • 1
    I have added the following in apache2.conf, I don't see the files anymore and the warning from CiviCRM is gone. Thanks a lot. <Directory "/var/www/html/wordpress/wp-content/uploads/civicrm/ConfigAndLog"> AllowOverride All </Directory>
    – Learn CiviCRM
    Commented Aug 24, 2023 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.