By jtt on

I have a root .htaccess file and then in my files directory a second one appears and when I delete it I can do thinks like see photos when running acidfree but when I create a new album or make changes the .htaccess file appears in the files subdirectory and causes 403 forbidden error page.

Can someone tell me how to fix this and in a step by step approach as I have no experience modifying .htaccess files - thanks, Jake.

⋅ Categories: Drupal 4.7.x

Comments

dman’s picture

dman commented

Did you try searching for ".htaccess files" to see what the story is?
Did you read the auto-generated .htaccess file to see the bit saying:
Drupal_Security_Do_Not_Remove
- it's there to prevent a certain exploit (XSS, IIRC)

NOW... if you are sure that you know more about webserver security than the folk that are trying to protect you from this danger, you can EDIT (not delete) the .htaccess file to be your own version, or even be just blank. The upload security check (that keeps trying to put it back there) just checks that an htaccess file exists. If you leave an empty file there, a new one will not be created, and you won't be protected from the exploit.

I assume that for some reason you are wanting the DirectoryIndexes back on.
If you want, you could try editing it so as to have
Options Indexes
instead of
Options None

.dan.
How to troubleshoot Drupal | http://www.coders.co.nz/

.dan. is the New Zealand Drupal Developer working on Government Web Standards

v1nce’s picture

v1nce commented

I would highly suggest you become familier with the apache.org site and documentation. What you need is found here regarding the .htaccess files.

-------------------------------------
CommunityTraveler

douggreen’s picture

douggreen commented

I ran into a similiar problem. On the chance that it's the same problem, here's my solution: http://drupal.org/node/86737

You can diagnose this by looking at the permissions on your auto-generated .htaccess file. Type the following commands (note that your files directory may be somewhere else and you'll need to change-directory to that directory):

$ cd sites/default/files
$ ls -l .htaccess.

If it has permissions "-rw-------", then you need to fix the permissions.

$ chmod 0644 .htaccess

Once the file is created, the system won't create it again. Thus, if this is your problem, just fix the permissions. You do not need to apply my patches from the other article.

Doug Green