It seems like I have some generic Apache configuration issue, but I cannot spot the problem.
I have Magento v2.2.7 installed to default Apache document root directory (/var/www/magento) under user magento (GID www-data). The corresponding Apache configuration is the following:
<Directory /var/www/magento>
Options -Indexes +FollowSymLinks
AllowOverride FileInfo Options=All,MultiViews AuthConfig Indexes
</Directory>
I haven't changed anything in .htaccess files – they are used as provided by Magento installation. For example, /var/www/magento/.htaccess contains the following:
Options +FollowSymLinks
RewriteEngine on
"Use Web Server Rewrites" option is enabled, and URL rewrites work appropriately. All resources (JS, CSS, fonts) are loaded correctly both in admin and store, except images that I have uploaded to Magento via admin interface, namely:
For example when I request URI /magento/pub/media/logo/websites/1/logo.jpg, status HTTP 403 is returned with the following logged to Apache error log:
# root@server:~# tail -f /var/log/apache2/error.log
[Wed Feb 20 10:54:56.588137 2019] [rewrite:error] [pid 24674] [client 189.64.12.201:10934] AH00670: Options FollowSymLinks and SymLinksIfOwnerMatch are both off, so the RewriteRule directive is also forbidden due to its similar ability to circumvent directory restrictions : /var/www/magento/pub/media/logo/websites/1/logo.jpg, referer: https://www.server.com/magento/
[Wed Feb 20 11:25:24.497872 2019] [rewrite:error] [pid 24698] [client 189.64.12.201:10400] AH00670: Options FollowSymLinks and SymLinksIfOwnerMatch are both off, so the RewriteRule directive is also forbidden due to its similar ability to circumvent directory restrictions : /var/www/magento/pub/media/catalog/product/cache/aefcd4d8d5c59ba860378cf3cd2e94da/5/2/52681140.jpg, referer: https://www.server.com/magento/home.html
Here is the uploaded logo:
magento@server:/var/www/magento$ ls -ld pub pub/media pub/media/logo pub/media/logo/websites pub/media/logo/websites/1 pub/media/logo/web
sites/1/logo.jpg
drwxr-x--- 1 magento www-data 176 Feb 17 23:37 pub
drwxrws--- 1 magento www-data 160 Feb 20 08:57 pub/media
drwxrwsr-x 1 www-data www-data 30 Feb 20 09:03 pub/media/logo
drwxrwsr-x 1 www-data www-data 2 Feb 20 09:03 pub/media/logo/websites
drwxrwsr-x 1 www-data www-data 16 Feb 20 09:03 pub/media/logo/websites/1
-rw-rw-r-- 1 www-data www-data 40324 Feb 20 09:03 pub/media/logo/websites/1/logo.jpg
When I enable SymLinksIfOwnerMatch
<Directory /var/www/magento>
Options -Indexes +FollowSymLinks +SymLinksIfOwnerMatch
AllowOverride FileInfo Options=All,MultiViews AuthConfig Indexes
</Directory>
then requests for images start to work, however once reindexing takes place, symlinks are created with www-data ownership and Apache refuses to follow them (hence everything breaks down):
[Mon Feb 18 11:27:06.360297 2019] [core:error] [pid 12079] [client 189.64.12.201:10400] AH00037: Symbolic link not allowed or link target not accessible: /var/www/magento/pub/static/adminhtml/Magento/backend/en_US/mage/requirejs/mixins.js, referer: https://www.server.com/magento/control/admin/system_config/index/key/2376d1328b68bd0679181a3c8e78f992e87a39157c80ffa0deadaaa617342843/
Site is in default mode:
magento@server:/var/www/magento$ ./bin/magento deploy:mode:show
Current application mode: default. (Note: Environment variables may override this value.)
Any suggestion about how to make images working without enabling SymLinksIfOwnerMatch are welcome.
