Broken Contact Images in 4.4.13, a .htaccess fix?

[CiviTeacher.com]

In 4.4.13 Contact images are not working due to a 403 (Forbidden) error.

Warning: getimagesize(https://site.org/sites/default/files/civicrm/custom/image_5ffe242f47046cc5b302714f92d4155e.jpg)

/sites/default/files/civicrm/custom/.htaccess

I changed it to contain:

Code: [Select]

<Files ~ "\.(jpg|jpeg|png|gif)$">
   order deny,allow
   allow from all
</Files>

Anyone see a problem with this?  Or is there a better solution to allow images to be seen?

[Chris Burgess]

See https://civicrm.org/advisory/civi-sa-2014-001-risk-information-disclosure which indicates the probable intentions of that .htaccess

I'm not sure about "custom" (it's not mentioned in that SA, and I find the names of the three or four upload folders unclear - CiviCRM has "custom", "upload", "images" and maybe something else, while Drupal uses clearer terminology "public" and "private"). It may be you don't need the .htaccess there at all, but it must have come from somewhere?

Adding .htaccess to these directories doesn't seem to have come in with the SA, but may have been a later addition which relates to same. The .htaccess may also have been added by your sysadmin thinking that "custom" is a private directory. Depending on your use of CiviCRM files, it may actually be.

For example, I've observed sites which used file attachments for both user avatars (public, probably) and staff documents (private, certainly). Since CiviCRM doesn't (?) permit sites to configure public or private per file, you need to apply your own document security process on a site-wide basis.

[CiviTeacher.com]

Thanks!

The .htaccess file was added by CiviCRM 4.4 or a prior version, not a human.  And the fact that CiviCRM gives me a warning about access to this directory lets me know that Civi knows what it's looking for and it's worried when I changed the .htaccess to allow gif|jpg etc images.

Any thoughts?

[Chris Burgess]

Looks like you're looking at https://issues.civicrm.org/jira/browse/CRM-14499 / https://issues.civicrm.org/jira/browse/CRM-15896

CRM_Utils_File::restrictAccess() installs those files.

CRM_Core_Config_Defaults::setValues() looks like the only call of that directed at "$customDIR" (which I'm going to assume is sites/default/files/civicrm/custom here, but those names get used confusingly sometimes, eg "uploadDir" is "customFileUploadDir" or something).

[CiviTeacher.com]

I have identified the issue.  Images uploaded in version 4.2 and prior retain the "old style" URL that is blocked by the new .htaccess file in 4.4.  Thus, this is separate bug relating to updating image paths in the 4.2 > 4.4 upgrade process.  I've added a comment here.

https://issues.civicrm.org/jira/browse/CRM-15897

[Chris Burgess]

Awesome, thanks for that! Good luck getting it sorted.

Reflected on how I find the naming / references to those directories a bit confusing and decided to try and collect their meanings in one place (maybe it should be wiki'd, but having to wiki documentation smells to me of a UX bug).

configAndLogDir

• set via: settings.php CIVICRM_TEMPLATE_COMPILEDIR s/templates_c/ConfigAndLog/
• example path: sites/default/files/civicrm/ConfigAndLog
• recommendation: Prohibit all web access
• documentation: (don't see any in civicrm.settings.php)

imageUploadDir

• set via: "Images" at civicrm/admin/setting/path
• example path: sites/default/files/civicrm/persist/contribute
• recommendation: Prohibit directory browsing
• documentation (from admin settings page):  "File system path where temporary CiviCRM files - such as import data files - are uploaded. File system path where image files are uploaded. Currently, this path is used for images associated with premiums (CiviContribute thank-you gifts)."

templateCompileDir

• set via: settings.php CIVICRM_TEMPLATE_COMPILEDIR
• example path: sites/default/files/civicrm/templates_c
• recommendation: Prohibit all web access
• documentation (from civicrm.settings.php): CIVICRM_TEMPLATE_COMPILEDIR is the file system path where compiled templates are stored. These sub-directories and files are temporary caches and will be recreated automatically if deleted.

uploadDir

• set via: "Temporary files" at civicrm/admin/setting/path
• example path: sites/default/files/civicrm/upload
• recommendation: Prohibit all web access
• documentation  (from admin settings page):  " File system path where temporary CiviCRM files - such as import data files - are uploaded. "

customFileUploadDir

• set via: "Custom Files" at civicrm/admin/setting/path
• example path: sites/default/files/civicrm/custom
• no recommendation given in CIVI-SA-2014-001
• documentation  (from admin settings page): " Path where documents and images which are attachments to contact records are stored (e.g. contact photos, resumes, contracts, etc.). These attachments are defined using 'file' type custom fields. "