By jmeckley on
I enabled the upload module that comes standard with Drupal
The folder has 766 permissions so users can read and write files to the directory. However when I try to view an attachment from the post I get 403 error.
I have enabled clean urls and I am using the default .htacess file with most of the options commented out. the 'Files' tags are not commented out.
Has anybody had this problem before. Is there a solution/work around?
Comments
same here -- help please!
I checked access permissions in the admin menu. I can't view a file attached to an article either as authenticated user or as admin -- get a 403 error. If I download the file all I get is the error page!
Changing the permission on the files directory has been the solution. But how safe is it?
My permissions
Sorry, I didn't have the time to add what permissions I gave to the "files" directory : 731
I don't think you even need to give the group any read permissions so you can try 711
Inside the directory you may check permissions too : 644 seems to work fine.
Good luck!
I just started having this problem in a fresh install of 4.7.2
I just started having this problem on a fresh install of 4.7.2
I do NOT have clean URLs turned on, and I'm trying to serve files directly from HTTP.
I have the default .htaccess file
Anything that gets put in /files (whether I uploaded it or created it directly on the server with vi) seems to get a 403 error.
So I've figured out that /files/.htaccess is what's preventing attachments from being viewable.
If I rename that file to /files/htaccess.bak attachments work...for a little while....until that file magically re-apears in /files!!!
I dno't have cron running, so something in the drupal core is checking for the existence of that .htaccess and re-creating it.
So, I read over the .htaccess file that refuses to die...and I saw that I shoudl read SA_2006_006...so I did (it's here http://drupal.org/node/65409 ).
The problem is, it doesn't tell you how to fix the security hole and still allow for public viewing of uploaded files in /files
Can anyone help here?
Some details
So, I figured this out (all by myself) .... I was dissapointed to get zero replies to my query...so I'll post this here hoping that someone else having this issue will read the solution.
It's simple... the folder /files which houses your uploaded content has a .htaccess file.
Drupal will re-create the file if you remove it. If you set the permissions to prevent drupal from creating the .htaccess file, then you cannot upload files either.
The solution that I'm using (which may be insecure...any advice, anyone?) is to replace the .htaccess file with this:
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Order Allow,Deny
Allow from all
That opens access to the folder, but also convinced drupal to leave me alone and quit re-creating the uselessly resrictive .htaccess that it shipped with.
Ciao!
I have been having the same
I have been having the same issue, thanks for the post on a fix.. although it would be ncie to know if it is secure.
I promise it's not as secure
I promise it's not as secure as it should be.
The .htaccess I posted essentially says to Apache "allow everything".
It's only a "fix" because Drupal requires the file to be there....so I changed the file to allow-all.
There is a better fix out there, but it lies in properly configuring .htaccess to be secure....something I don't need given my site is behind a firewall.
The alternative is to tell Drupal to handle downloads (instead of letting them route directly through Http). This is the suggested fix from a security standpoint I believe. Problem is, I use TinyMCE+DrupalImage plugin and that doesn't work (at all) with Drupal-assisted downloads (you have to let them be pure HTTP).
Oh well, if you want to use DRupal to run downloads, you can go back to the standard .htaccess file and then go to:
Administer->settings->file system settings->Download method (set this to private)
That'll work for most stuff, but not for the situation I've outlined above.
Thank you
at least this is a starting point.