Help: Upgrade to 4.7.2 leaves images unaccessable. This issue has been reported but my questions further-on really concerns the best practice for uploading image files to Drupal stories, which falls under this forum topic!

I have just upgraded an existing site from Drupal 4.6.1 to 4.7.2

The problem I am experiencing stems from the following subjects and is identical to the issue that has been posted regarding SA_2006_006, but I have further questions.

http://drupal.org/files/sa-2006-006/advisory.txt
http://drupal.org/drupal-4.7.1
http://drupal.org/node/68685

The images in the directories under files are inaccessable due to the security .htaccess file that is created under files and is described in the above posts/issues. If I delete .htaccess, the next cron.php run seems to recreate it. My temporary, albeit very insecure, arrangement has been to leave the line "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006" and to comment the rest of the file, which needless to say nullifies the security.

This specific site is for an estate agent and I have created FTP access to the files/img directory where numerous images for every property are uploaded into files/img/2006x001 or files/img/2006x195 directories where the last digits of the directory scheme determines a property code. Those files are uploaded from an identical structure on the Estate Agent's PC via FTP and are not transferred through Drupal at all. Their file permissions are automatically set to full read/write + owner execute. Specifically, these are the files that have the problems with the new Drupal sa-2006-006. The relative URLs of the image files are all in the format of "files/img/2006x001/file_abc.jpg" and so on in the appropriate stories within Drupal. This particular estate agent prefers this scheme of storing images etc and up to now it has worked effectively. A certain period after the properties are sold, the complete image directories are deleted via FTP. The agent wants it that way since it is embarassing if the client that has recently purchased a home believes that the estate agent is trying to sell the house again via the Internet! There is a taxonomy catagory determining "for sale" / "sold" / "purged" that controls (via PHP snippets) what type of property appears in what catagory of property listing. Stories in the catagory 'purged' are periodically deleted entirely, since the Google Sitemap module still produces links for all pages though they are not necessarily accessible from the site navigational structure. My long-term goal is to replace this structure via something developed in CCK (one day when CCK becomes really stable, commonplace, well documented etc), but for now the existing arrangement actually works very effectively. (This is an ultra-low-budget effort, but Drupal has done an absolutely sterling job so far!)

This is my question: Had I transferred the files via Drupal (as opposed to FTP), would the same have happened?

Certainly it is more effective transferring a complete directory structure (via FTP) for properties for the next month to the Drupal files/img dir. The alternate would have meant uploading those files individually into files via HTTP and if a further directory structure was required under files, it would have to be created through an FTP tool under files.

I have realised that on a substantial number of Drupal sites I have uploaded many image elements into files/img and associated subdirectories via FTP. Am I going to experience this problem on all those sites? (It looks like it.)

What is the preferred or best practice way of transferring (uploading) graphical images (to be used in individual stories) in Drupal?

Simply uploading a file under Drupal dumps it in files. This is exactly what I am trying to avoid - having a zillion images under files two years from now without a hierarchical structure to sort them out. Am I correct to assume that this is how it works?

I am afraid this issue has left me somewhat confused in that the way I used to do something no longer appears to be the best way.

Comments

heine’s picture

Wow, I got lost somewhere along the way but you fortunately bolded the question :)

This is my question: Had I transferred the files via Drupal (as opposed to FTP), would the same have happened?

I believe the answer would be yes.

You may try this .htaccess (from http://drupal.org/node/67244) in files:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options FollowSymLinks
<IfModule mod_rewrite.c>
RewriteEngine off
</IfModule>

Or even

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

See also: http://drupal.org/node/67244

--
The Manual | Troubleshooting FAQ | Tips for posting | Make Backups! | Consider creating a Test site.

vizechef’s picture

Having similar requirements I had the same problem as Casperl.
It helped me to disable 'Options none'.
I am not (yet) very familiar with htaccess syntax and still do not know exactly what I have done but I was in a hurry and it worked fine.
Disabling the 'SetHandler' statement didn't change anything !?
So, the whole thing depends on the ISP's basic configuration and there might be different solutions for the same problem.

heine’s picture

Removing the Option None, probably works because some server / site configurations need Options FollowSymLinks. So if you remove the Options None, you usually have Options FollowSymLinks enabled again.

Alternatively Option overrides may not be allowed (you can check the .htaccess in Drupal root), so removing it alltogether may enable files access again.

Better not remove the SetHandler statement, unless it's forbidden by your provider.
--
The Manual | Troubleshooting FAQ | Tips for posting | Make Backups! | Consider creating a Test site.

vizechef’s picture

I tried Options FollowSymLinks but got the same result - no pics anymore.
I forgot that I had to disable all option overrides in Drupal root htaccess when I first started my site few months ago.
So - options do not work for me :-(

heine’s picture

Alternatively Option overrides may not be allowed (you can check the .htaccess in Drupal root), so removing it alltogether may enable files access again.

Well, so that seems to be the case for you. Simply use it without the Options directive.
--
The Manual | Troubleshooting FAQ | Tips for posting | Make Backups! | Consider creating a Test site.

bacon333’s picture

I'm also trying to find a way to store images by date and perhaps title of the article (/2006-06-20/todaysarticle). I've been using ibrowser with tinymce to insert images but all the images get dumped into one folder. I'm looking into Gallery but that system looks pretty hardcore for what I want to do.

Any suggestions?