CiviCRM Community Forums (archive)

See https://civicrm.org/advisory/civi-sa-2014-001-risk-information-disclosure which indicates the probable intentions of that .htaccess

I'm not sure about "custom" (it's not mentioned in that SA, and I find the names of the three or four upload folders unclear - CiviCRM has "custom", "upload", "images" and maybe something else, while Drupal uses clearer terminology "public" and "private"). It may be you don't need the .htaccess there at all, but it must have come from somewhere?

Adding .htaccess to these directories doesn't seem to have come in with the SA, but may have been a later addition which relates to same. The .htaccess may also have been added by your sysadmin thinking that "custom" is a private directory. Depending on your use of CiviCRM files, it may actually be.

For example, I've observed sites which used file attachments for both user avatars (public, probably) and staff documents (private, certainly). Since CiviCRM doesn't (?) permit sites to configure public or private per file, you need to apply your own document security process on a site-wide basis.

Looks like you're looking at https://issues.civicrm.org/jira/browse/CRM-14499 / https://issues.civicrm.org/jira/browse/CRM-15896

CRM_Utils_File::restrictAccess() installs those files.

CRM_Core_Config_Defaults::setValues() looks like the only call of that directed at "$customDIR" (which I'm going to assume is sites/default/files/civicrm/custom here, but those names get used confusingly sometimes, eg "uploadDir" is "customFileUploadDir" or something).

Awesome, thanks for that! Good luck getting it sorted.

Reflected on how I find the naming / references to those directories a bit confusing and decided to try and collect their meanings in one place (maybe it should be wiki'd, but having to wiki documentation smells to me of a UX bug).

configAndLogDir

• set via: settings.php CIVICRM_TEMPLATE_COMPILEDIR s/templates_c/ConfigAndLog/
• example path: sites/default/files/civicrm/ConfigAndLog
• recommendation: Prohibit all web access
• documentation: (don't see any in civicrm.settings.php)

imageUploadDir

• set via: "Images" at civicrm/admin/setting/path
• example path: sites/default/files/civicrm/persist/contribute
• recommendation: Prohibit directory browsing
• documentation (from admin settings page):  "File system path where temporary CiviCRM files - such as import data files - are uploaded. File system path where image files are uploaded. Currently, this path is used for images associated with premiums (CiviContribute thank-you gifts)."

templateCompileDir

• set via: settings.php CIVICRM_TEMPLATE_COMPILEDIR
• example path: sites/default/files/civicrm/templates_c
• recommendation: Prohibit all web access
• documentation (from civicrm.settings.php): CIVICRM_TEMPLATE_COMPILEDIR is the file system path where compiled templates are stored. These sub-directories and files are temporary caches and will be recreated automatically if deleted.

uploadDir

• set via: "Temporary files" at civicrm/admin/setting/path
• example path: sites/default/files/civicrm/upload
• recommendation: Prohibit all web access
• documentation  (from admin settings page):  " File system path where temporary CiviCRM files - such as import data files - are uploaded. "

customFileUploadDir

• set via: "Custom Files" at civicrm/admin/setting/path
• example path: sites/default/files/civicrm/custom
• no recommendation given in CIVI-SA-2014-001
• documentation  (from admin settings page): " Path where documents and images which are attachments to contact records are stored (e.g. contact photos, resumes, contracts, etc.). These attachments are defined using 'file' type custom fields. "