False Negative for Writeable .htaccess on NGINX

Created on 8 January 2015, about 10 years ago
Updated 10 January 2025, 13 days ago

If I am running an NGINX webserver with a fully writeable files directory, Security Review will complain that "The .htaccess file is writeable which poses a risk should a malious user find a way to execute PHP code they could alter the htaccess file to allow further PHP code execution.".

As NGINX doesn't process the .htaccess file, might it be appropriate to use a variable like $_SERVER["SERVER_SOFTWARE"] to restrict this check to Apache?

Alternatively, maybe the module can add a test file to the files directory to see if code execution is possible. After all, even if .htaccess says the right things the web server's configuration may be problematic.

🐛 Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

🇺🇸United States populist

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇺🇸United States emjayess

    I'm here because of a search for similar behavior in Drupal core's status report. First I thought I'd stumbled into just the right issue, then was scratching my head because of the closed status and note about this landing in a commit... yes, it took me a minute or three to realize I was in the issues for Security Review module, instead of drupal proper.

    So the question is) does anyone have any insights as to whether any similar detection of web server has been proposed for Drupal core? Because if I'm not using Apache, I would much rather NOT have this warning about `.htaccess` always staring at me (or my clients) in the status report.

  • 🇺🇸United States greggles Denver, Colorado, USA

    @emjayess thanks for the followup. Can you post a screenshot of the message in the status report?

  • 🇺🇸United States emjayess

    Can you post a screenshot of the message in the status report?

    Certainly, attached. Thanks for taking interest.. although I'm sure this is not the best place to take up the issue.

    If it matters, this is a site currently running Drupal 10.4.0, which had recently been upgraded from version 8, then version 9, etc. And it is running on Pantheon; my local/dev environment also uses nginx (valet).

  • 🇺🇸United States greggles Denver, Colorado, USA

    @emjayess that error message comes from core's system.install.

    Here's an issue that I think is relevant to your goal of making it more appropriate for nginx users 🐛 Only show the error “Public files directory Not fully protected” for Apache servers Needs work

  • 🇺🇸United States emjayess

    🙏🏼 Thank you for the direction @greggles!

Production build 0.71.5 2024