Currently if you have your files directory at /sites/default/files and also a malicious directory that is web-writable at /files/ then the second directory is not identified as a problem. Ideally the module should identify the second directory as a potential problem.

CommentFileSizeAuthor
#1 1645752_only_ignore_specific_files_dir.patch1.42 KBgreggles

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review
StatusFileSize
new 1645752_only_ignore_specific_files_dir.patch1.42 KB

and patch.

If this works for you then I can re-roll #1645750: identify private files as a non-dangerous writable dir to apply after this and use the extra './' .

crimsondryad’s picture

crimsondryad commented

We are running multisite installs and we also use a custom directory for files ( ie, not /sites/default/files ) in the Drupal webroot ( ie /media-assets ). In this case, it seems like not only should the patch check /sites/default/files, but also whatever the Drupal files path is defined as in Configuration > File System

coltrane’s picture

coltrane
he/him
commented
Status: Needs review » Fixed

@crimsondryad it does use the variable that contains the path set at Admin > Configuration > File System.

Patch works well, thanks greggles! http://drupalcode.org/project/security_review.git/commit/aa1422d

coltrane’s picture

coltrane
he/him
commented
Version: 7.x-1.x-dev » 6.x-1.x-dev
Status: Fixed » Patch (to be ported)

Re-opening to port to D6.

coltrane’s picture

coltrane
he/him
commented
Status: Patch (to be ported) » Fixed

Fixed in 6. http://drupalcode.org/project/security_review.git/commit/604f2b8

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.