This is for DRUPAL_5 and DRUPAL_4_7_3.
The .htaccess file that drupal generates in file_directory_path() breaks file previews when clean url's are enabled.

The lines at fault are Options None and RewriteEngine Off.

I know these lines were added as a part of a security fix, but upload_munge_filename was added as well which does a far better cross platform job than the apache specific .htaccess fixes.

CommentFileSizeAuthor
filepreviews.patch.txt861 bytesdopry

Comments

morbus iff’s picture

In going through all my logs on that, dopry and I reached a tentative agreement on this patch, under the assumption that Steve Dondley (who submitted http://drupal.org/node/67244) would have to test and approve it before going forward.

dopry’s picture

As an annotation the original reasoning for add the RewriteEngine off with the multiviews fix from Morbus's IRC logs.

May 29 20:41:46 Options FollowSymLinks or SymLinksIfOwnerMatch is off which implies that RewriteRule directive is forbidden: /Users/morbus/Conquest/DrupalHEAD/files/_test.php.txt
May 29 20:43:03 xxxxx: add RewriteEngine Off

Since then Option +FollowSymlinks was added resolve http://drupal.org/node/67244

dopry’s picture

Still holding on Steve Dondeley to test. Locally and on my testing and staging servers I haven't been able to reproduce this error, but they're all identical configs as far as apache/php/mysql is concerned.

Steve Dondley’s picture

Using the cvs version of Drupal downloaded today, I don't appear to have the issue with file uploads that I had with the older version, 4.7.x version. File attachments and new logo uploads work fine without the patch installed.

When the 3-line conditional, beginning with <IfModule mod_rewrite.c>, was commented out of the files/.htaccess file, it had no effect on file upload operation.

chx’s picture

Status: Needs review » Reviewed & tested by the community

[16:05] chx: well, the rewrite stuff was originally added to satisfy Options None.
[16:06] but that wasn't "enough", so we had to add Options FollowSymLinks per http://drupal.org/node/67244
[16:06] Options FolllowSymLInks "fixes" everything /without/ requiring the mod_rewrite ilnes.
[16:06] and now we know for sure that we can remove them without breaking stuff?
[16:06] and now we know for sure that we can remove them without breaking stuff?
[16:07] chx: well, as sure as we were on all the other particular tweaks to this file.
[16:07] chx: however, we're fighting various ways of configuring Apache, not internal ignorance.

it seems we are better with this patch committed than without.

dopry’s picture

Also not to confuse what is at issue here... It is not the file uploads. In order to properly reproduce this error.

1) install clean drupal (4.7.3 or head).
2) enable clean urls.
3) goto node/add/story
4) attach an image file
5) create an <img> tag in the body using the url provided in the file upload box for the image.
6) hit preview, not submit.

You will not see the image preview. If you remove the rewrite engine off from the .htaccess it will work.

This happens because file attachments are not saved to their final location until a node is submitted. However, it is very handy to have that final url when creating a node, so a menu callback is used until the node is submitted.

Since the final url for uploaded attachments will be something like 'files/.../...' and rewrite is disabled in 'files/' you cannot have file previews. The rewrite engine must be on and Options FollowSymlinks is required for the rewrite engine to do internal rewrites. (Morbus, Correct me if I'm wrong).

I believe files in node previews with clean urls enabled and public files is the only core issue here.
I

dries’s picture

Status: Reviewed & tested by the community » Fixed

Committed to DRUPAL-4-7 and CVS HEAD. Thanks.

Anonymous’s picture

Status: Fixed » Closed (fixed)
dkatzman’s picture

Version: x.y.z » 5.0

Hi,

How can I disable Drupal from creating the .htaccess in the files folder again and again?

Thanks,

DK

  • www.secretia.com
  • www.unmentor.com
  • www.mythos.es
  • www.jewishculturela.org
  • www.profesorblog.com
  • www.drbolsa.com
  • www.certifik.org