>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3550828. --> Reported by: [ressa](https://www.drupal.org/user/102134) Related to !88 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>After following the guidelines on the <a href="https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership">Securing file permissions and ownership</a> documentation page, and running this module, the report says "PHP files in the Drupal files directory can be executed.".</p> <p>On the "Executable PHP" page it says:</p> <blockquote><p>The Drupal files directory is for user-uploaded files and by default provides some protection against a malicious user executing arbitrary PHP code against your site. Read more about the <a href="https://drupal.org/node/615888">risk of PHP code execution on Drupal.org</a>.</p> <p>The .htaccess file is writable which poses a risk should a malicious user find a way to execute PHP code they could alter the .htaccess file to allow further PHP code execution.</p></blockquote> <p>From <code>/admin/reports/security-review/help/security_review/executable_php</code>.</p> <p><code>.htaccess</code> is 660:</p> <pre>$ ls -al web/sites/default/files | grep .htacces<br>-rw-rw----&nbsp;&nbsp; 1 user&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; www-data&nbsp;&nbsp;&nbsp;&nbsp; 486 12 feb&nbsp; 2025 .htaccess</pre><p>Setting it to read-only seems to satisfy Security Review:</p> <pre>$ chmod 440 web/sites/default/files/.htaccess<br>$ ls -al web/sites/default/files | grep .htacces<br>-r--r-----&nbsp;&nbsp; 1 user&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; www-data&nbsp;&nbsp;&nbsp;&nbsp; 486 12 feb&nbsp; 2025 .htaccess</pre><p>The report goes green and says:</p> <p>"PHP files in the Drupal files directory cannot be executed."</p> <p>The permission is probably set by the last line, from the <a href="https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership">Securing file permissions and ownership</a> doc page:</p> <pre>$ cd /var/www/example.org/public_html/web/sites<br>$ find . -type d -name files -exec chmod ug=rwx,o= '{}' \;<br>$ find ./*/files -type d -exec chmod ug=rwx,o= '{}' \;<br>$ find ./*/files -type f -exec chmod ug=rw,o= '{}' \;</pre><p>Is that correct, or should we recommend another command?</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <ol> <li> <p>Check if the documentation is correct:<br> &#9989; Yes, it is correct.</p> <blockquote><p>For Drupal to protect against PHP file execution in the Drupal files directory then a .htaccess file needs to exist with the following content and <strong>not</strong> be writeable by the webserver.</p></blockquote> <p>From <a href="https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/preventing-execution-of-untrusted-php">Preventing execution of untrusted PHP</a>. </p></li> <li> Check if the recommended steps to secure folders and files is correct:<br> &#9989; Command to make <code>.htaccess</code> read-only could be added, and it has been, as seen below. <blockquote><p>For the "files" directory in the sites/default directory and any other site directories in a multi-site installation, the permissions are slightly different because the <code>www-data</code> user must have write permission to the directory:</p> <pre>$ cd /var/www/example.org/public_html/web/sites<br>$ find . -type d -name files -exec chmod ug=rwx,o= '{}' \;<br>$ find ./*/files -type d -exec chmod ug=rwx,o= '{}' \;<br>$ find ./*/files -type f -exec chmod ug=rw,o= '{}' \;<br>$ find ./*/files/.htaccess -type f -exec chmod ug=r,o= '{}' \;</pre></blockquote> <p>From <a href="https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership">Securing file permissions and ownership</a>. </p></li> <li> Verify if the check in the code is correct:<br> &#9989; It works well, and as intended. <pre>if ($writable_htaccess) {<br>&nbsp; $findings[] = 'writable_htaccess';<br>&nbsp; if ($result !== CheckResult::FAIL) {<br>&nbsp;&nbsp;&nbsp; $result = CheckResult::WARN;<br>&nbsp; }<br>}</pre><p>From <a href="https://git.drupalcode.org/project/security_review/-/blob/3.1.x/src/Plugin/SecurityCheck/ExecutablePhp.php#L90">https://git.drupalcode.org/project/security_review/-/blob/3.1.x/src/Plugin/SecurityCheck/ExecutablePhp.php#L90</a>. </p></li> <li> We could include "... and <a href="https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership" rel="nofollow">Securing file permissions and ownership</a>" in the <a href="https://git.drupalcode.org/project/security_review/-/blob/3.1.x/src/Plugin/SecurityCheck/ExecutablePhp.php#L29">src/Plugin/SecurityCheck/ExecutablePhp.php</a> message, to give the users a solution?<br> &#9989; The MR has been committed. </li> </ol> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <h3 id="summary-ui-changes">User interface changes</h3> <h3 id="summary-api-changes">API changes</h3> <h3 id="summary-data-model-changes">Data model changes</h3>