For Drupal 7 we changed the files/.htaccess permissions to be 0444 in #517814: File API Stream Wrapper Conversion without much discussion of why.

We should do that for Drupal 6 and Drupal 5 as well. Otherwise this .htaccess doesn't provide a ton of value as it can be easily changed by Apache to be less restrictive. Since Apache already owns that file, it is obviously still possible (but slightly harder) to modify those permissions back.

This is a public hardening brought to you by greggles from the Security Team.

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

subscribing.

Status: Active » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.