SA-CORE-2013-003 and Nginx

I haven't checked the patch in core, but if they look for an .htaccess it won't work.

You have to add

to the listet .htacceass. It doesn't change a bit for nginx but drupal is justified.

In your nginx.conf you have to secure this directories to does NOT execute php-files.

So far as I understand this item.

migmedia

If you have something like this:
1. A location just for index.php and
2. an extra location for *.php after that,
any execution of php-Files anywhere except index.php is forbidden. That's the meaning of the .htaccess-file as far as I understand.

 location ^~ /index.php {
 include fastcgi.conf;
 fastcgi_pass 127.0.0.1:9000;
 }
 ## Any other attempt to access PHP files returns a 404.
 location ~ \.php$ {
 return 404;
 }

Why are you using a

The code is in lines 261-292 of modules/system/system.install, in a hook_requirements() implementation. It is looking for an .htaccess in public://, private:// (if applicable), and temporary://, and specifically for the "Drupal_Security_Do_Not_Remove_See_SA_2013_003" line inside of them, but before it does that it tries to create the .htaccess files via file_ensure_htaccess(), so it seems to me that if you're seeing this error, it means Drupal can't write to a directory(ies) it needs to, and therefore you have other problems.

Of course, Nginx (or Lighty or IIS or so on) can't do anything with the .htaccess files, but I don't think there's any harm in letting Drupal go ahead and create them. Just remember to lock down your site in other ways, preferably by just using perusio's config, which is sometimes annoyingly secure by default.

Perhaps a more robust test for this security problem would be for Drupal to create a PHP file in those directories and try to execute it via drupal_http_request().

The Boise Drupal Guy!

Like this: https://drupal.org/comment/8213137#comment-8213137

You can find related patches for D7 and D6 in this issue: https://drupal.org/comment/8213633#comment-8213633

Okay, looking into things (and after finally getting around to update the dev version of my site myself...), I was seeing these errors after upgrading even though the directories were perfectly writable. It turns out that if there's already an .htaccess file in those directories, Drupal doesn't seem to rewrite the directories with the new versions required to make that error go away. That seems like a pretty dumb oversight (or at least one made in a hurry) and not Nginx-specific.

Probably the easiest way to fix it is to just manually delete the .htaccess files, then reload the status report page. Drupal will recreate the .htaccess files with the necessary lines right before it checks if they exist again.

The Boise Drupal Guy!

That's still a bug

that Drupal continues to be bound to legacy tech like Apache. The patch in core is Apache centric. What it needs to be done for all users is to have a module/function that traverses all Drupal aware directories creates a oneliner PHP script and issue an HTTP request to see if gets a 200 status reply.

Relying on checking for .htaccess is going deeper into Apache only land, which besides being sad goes agianst the Zeitgeist.

Patches welcome.

Please help improve my patches to get it (kinda) fixed in Drupal core finally: https://drupal.org/node/1559116

I respectfully disagree with

• brianmercer
• omega8cc
• perusio
• yhager

• Arabic
• Alappuzha
• Event Platform
• Western Ohio User Group
• Goa Drupal Community
• Liverpool
• Chandigarh Drupal Geeks (C.D.G.)
• API-First Working Group
• Compony opinionated developers
• 4SPOTS