Hello,

When I try to display an internal Drupal folder such as /misc I get the proper 403 Forbidden response.

When I try to browse the /files folder (or any subdirectory of it), however, no error is raised, but the home page is being displayed (with the layout potentially broken, since the base URL still points to http://mysite.com/files).

This bug is easy to reproduce: http://drupal.org/files/ :-)

The cause seems to be the SetHandler directive in files/.htaccess. While I understand that there is a good reason for this line, access to directories should still result in 403 (or be redirected to some dedicated page).

Regards
Ralph

Comments

Status: Active » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.