identify private files as a non-dangerous writable dir

Needs work per #1645752: make files security check more paranoid

I encountered that too. I have created a private file and set permission to "777" at the root directory.

Security module identified this as problem. But if I don't set "private" as "777", configuration at File system page will have problem to save. Security review module take it as problem.

Updated comment for check and found that the private files check only ran if private files was set as default. That check should run whenever the private files directory is set. Sneaking that into this patch.

had to remove the private files test now that it's being checked correctly.

And those last two were the wrong patches. Here we go!

Committed http://drupalcode.org/project/security_review.git/commit/1e83b2a

Did somebody test this? To me it continuos to set 'private_files' as dangerous to be writable.

With the patch applied to an older version of the module or with the module holding commit.

I tested but it sounds like additional testing is necessary! Where is your private files directory? Can you confirm it's listed in this check when running 7.x-1.x-dev branch on your site?

I now downloaded latest 7.x-1.x-dev version through git and did security review.

I get:

It is recommended that the following files or directories be corrected.

./private_files/backup_migrate/manual/test.txt
./private_files/backup_migrate/scheduled
./private_files/backup_migrate
./private_files
As well as all the files inside this directory

So yes, it needs to be reviewed ;)

Not to belabor the point, but can you confirm that 'private_files' is what you have entered as the path to you private files on admin/config/media/file-system ?

@RaulMuroc also what type of web server are you running this check on? I haven't yet been able to replicate this error so any information you can provide will be helpful, thank you.

In admin/config/media/file-system:
Private file system path
private_files

So this is correct :S

Web server:

Linux vls104.dinaserver.com 3.0.4-dh-xen-32 i686
apache2

Hope it helps.

Ah, I can replicate! I forget right now why a leading character is chopped off the private files string but it was causing it to not match when the private files directory was in the web root. This should fix it!

Committed http://drupalcode.org/project/security_review.git/commit/9c0fddd

Nice work :-)!