Working withtout "Options +FollowSymLinks"

Another option around the permission issue is to run php from cgi-bin (probably not optimum for very high traffic sites, but works well for most). I run a small webhosting company and I'm now doing this for my customers running PHP apps like Drupal, Joomla, Gallery, etc. By going this route you don't have to deal with the "nobody" files and directories as the php script now runs under your own account, and you don't have to set some directories to 777 to allow access to the owner and the world. Overall its more secure and easier for the customer to manage since they own all of the files (even ones created by the scripts).

Thank you, it worked!
I solved the problem this way using total commander:

• I connected via ftp to my server directory, where drupal files are placed
• I deleted /files and /includes
• I created via command lines directories /files and /includes (mkdir files | mkdir includes). Then I disconnected and connected again in order to see those newly created directories (I don't know, why, but I didn't see 'em the next moment I created them).
• I copied files to /include
• I created /htaccess file with text-editor which enabled me saving files in linux format.
• I copied this .htaccess to /files on my server.
• I changed access rights to /files

Hi

I was experiencing some problems with BUEditor and user pictures because of the .htaccess files drupal creates automatically with includes/file.inc.

My webhost does not allow any .htaccess files, i can just configure some options globally in the hosting control center. Removing the autogenerated .htaccess files got my user pictures, bueditor and probably other things that have not been working so far, working.

I know this is probably a pretty straight-forward and insecure approach as the .htaccess files are put in the directories for some security reasons too, but i had to comment out the lines in includes/file.inc (file_check_directory function) where drupal generates the .htaccess files as following:

function file_check_directory(&$directory, $mode = 0, $form_item = NULL) {
  $directory = rtrim($directory, '/\\');

  // Check if directory exists.
  if (!is_dir($directory)) {
    if (($mode & FILE_CREATE_DIRECTORY) && @mkdir($directory)) {
      drupal_set_message(t('The directory %directory has been created.', array('%directory' => $directory)));
      @chmod($directory, 0775); // Necessary for non-webserver users.
    }
    else {
      if ($form_item) {
        form_set_error($form_item, t('The directory %directory does not exist.', array('%directory' => $directory)));
      }
      return FALSE;
    }
  }

  // Check to see if the directory is writable.
  if (!is_writable($directory)) {
    if (($mode & FILE_MODIFY_PERMISSIONS) && @chmod($directory, 0775)) {
      drupal_set_message(t('The permissions of directory %directory have been changed to make it writable.', array('%directory' => $directory)));
    }
    else {
      form_set_error($form_item, t('The directory %directory is not writable', array('%directory' => $directory)));
      watchdog('file system', t('The directory %directory is not writable, because it does not have the correct permissions set.', array('%directory' => $directory)), WATCHDOG_ERROR);
      return FALSE;
    }
  }

/* UNCOMMMENTED BECAUSE WE DON'T WANT TO HAVE .htaccess FILES IN DIRS (not permitted by host)
  if ((file_directory_path() == $directory || file_directory_temp() == $directory) && !is_file("$directory/.htaccess")) {
    $htaccess_lines = "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006\nOptions None\nOptions +FollowSymLinks";
    if (($fp = fopen("$directory/.htaccess", 'w')) && fputs($fp, $htaccess_lines)) {
      fclose($fp);
      chmod($directory .'/.htaccess', 0664);
    }
    else {
      $message = t("Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your %directory directory which contains the following lines: !htaccess", array('%directory' => $directory, '!htaccess' => '<br />'. nl2br(check_plain($htaccess_lines))));
      form_set_error($form_item, $message);
      watchdog('security', $message, WATCHDOG_ERROR);
    }
  }*/

  return TRUE;
}