6

I'm noticing a lot in the logs whereby the server itself is trying to request a resource that CiviCRM denies access to by .htaccess.

Specifically it seems the CiviCRM server is trying to fetch files of this pattern:

/sites/default/files/civicrm/upload/delete-this-d3542fs2sP
/sites/default/files/civicrm/custom/delete-this-D44i89qZNP

Yet both of those directories contain .htaccess files with Deny all statements.

Anyone shed any light on this? [4.4.20 LTS, Drupal 7]

4

I have discovered that the delete-this files are temporary files created by CiviCRM for the sole purpose of generating this error! This error is good, it means that these directories are not browseable, and they shouldn't be browseable.

CiviCRM's CRM_Utils_Check_Security class does these checks in order to report what would-be security errors.

It creates a file, then tries to access that file via http. This should fail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.