By Samat Jain on

From the Drupal 4.6.7/4.7.1 release announcement and security advisory:

Make sure you have a .htaccess in your "files" dir and it contains this line:

SetHandler This_is_a_Drupal_security_line_do_not_remove

Pardon me for not going through the mailing lists, but what is this for and how is this supposed to work?

⋅ Categories: Drupal 4.6.x, Drupal 4.7.x

Comments

chrisd’s picture

chrisd commented

I don't use .htaccess files .

Do I fix this problem by adding the following in my http.conf inside the:

<virtualhost 1.1.1.1>
<Directory "E:/DomZeus/delsolcom/wwwroot/">
.../...
</Directory>

<Directory "E:/DomZeus/delsolcom/wwwroot/files">
SetHandler This_is_a_Drupal_security_line_do_not_remove
</Directory>
</virtual>

Is there a way to verify ?

Thanks,
C

Samat Jain’s picture

Samat Jain commented

That should work fine, and is also how I probably will setup this directive. I like to turn off .htaccess parsing on my Drupal directories.

But my question is, how/why does this work?
__
Personal home page | Rhombic Networks: Drupal-friendly web hosting

Lourens’s picture

Lourens commented

I'm not an Apache guru either, but from the documentation, SetHandler defines how a file is interpreted by the Apache server. By default, files with certain extensions are handled by certain handlers, e.g. a .php file is handled by mod_php, which means it gets executed. Some servers (like my Ubuntu server) apparently also execute .cgi-script files as CGI scripts. The directive SetHandler changes this, and by setting a nonexistant handler you prevent the files from being executed. Anyone requesting that file will simply get the file itself, without any interpretation or execution on the server side. For the files directory, this is exactly what you want.

Note that this only works if the Apache configuration allows overriding the SetHandler directive from .htaccess files. For me, this wasn't the case, meaning that just adding the .htaccess file didn't solve the problem for me. I had to add a /etc/apache2/conf.d/drupal file containing 

<Directory /path/to/drupal/files>
        SetHandler This_is_a_Drupal_security_line_do_not_remove
</Directory>

to make my system secure.

heine’s picture

heine commented

That's indeed the right thing todo when you can access httpd.conf and do not use .htaccess. Verify by putting a .php file in your files directory, then access the file with a URL.
--
When your problem is solved, please post a follow-up to the thread you started.

Thomas Sewell’s picture

Thomas Sewell commented

if you are using a multi-site drupal configuration with each site's document root symbolicly linked to your drupal directories, you will need to add the above directory statement to each virtual host definition and specify the path/to/files for each different doc root.

ldsandon’s picture

ldsandon commented

I had to comment out the SetHandler directive because I got error 500, end in the error log there was:

[Fri Dec 29 10:09:56 2006] [alert] [client 192.168.102.200] ****/htdocs/files/.htaccess: SetHandler not allowed here

Only administrators can upload files in my installation, therefore it shouldn't be a issue.

LDS