I'm noticing a lot in the logs whereby the server itself is trying to request a resource that CiviCRM denies access to by .htaccess.
Specifically it seems the CiviCRM server is trying to fetch files of this pattern:
/sites/default/files/civicrm/upload/delete-this-d3542fs2sP
/sites/default/files/civicrm/custom/delete-this-D44i89qZNP
Yet both of those directories contain .htaccess files with Deny all statements.
Anyone shed any light on this? [4.4.20 LTS, Drupal 7]
I have discovered that the delete-this files are temporary files created by CiviCRM for the sole purpose of generating this error! This error is good, it means that these directories are not browseable, and they shouldn't be browseable.
CiviCRM's CRM_Utils_Check_Security class does these checks in order to report what would-be security errors.
It creates a file, then tries to access that file via http. This should fail.
ConfigAndLog.xxxxxxxxxxxxxxxxxxxxxxxx.log) is not web-accessible. See this related question: civicrm.stackexchange.com/questions/11918/…
Commented
May 31, 2017 at 0:22