Score:1

How does SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006 work exactly?

ca flag

I ran into an issue (When using fpm, it is not clear how to make image styles work ) which I traced back to the use of Drupal_Security_Do_Not_Remove_See_SA_2006_006 in sites/default/files/.htaccess.

In order to continue debugging I would need a more solid understanding of what exactly "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006" does in that file, because when I comment it out, my issue is resolved.

Is there code somewhere which "Handles" files? If so where? I have searched Drupal and cannot find any actual logic behind this.

sonfd avatar
in flag
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2006-05-25/sa-2006-006-drupal-core-execution
Jaypan avatar
de flag
From reading that, it appears that this is to prevent scripts in your files directory, where files are uploaded to, cannot be executed. Without this, a hacker could potentially upload a script to that directory and access it.
apaderno avatar
us flag
This is a question about Apache. (*What happens when the handler set for a directory doesn't exist?*) Drupal doesn't have any Drupal_Security_Do_Not_Remove_See_SA_2006_006.* file, as you already found out, which means that handler doesn't exist.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.