18

My Magento 2 development environment has started poking me with the following error message

Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider

Has anyone tracked down

  1. What security checks are happening?
  2. Where in the core code these checks happen?
  • can u please tell me which version of 2,you have use – Amit Bera Feb 12 '16 at 5:16
  • @AmitBera With individual packages being composer repositories I'm not really sure how to check that – Alan Storm Feb 12 '16 at 5:17
  • 1
    @AlanStorm, this message came from Magento\AdminNotification\Model\System\Message\Security class. which situation you got this message? – Bojjaiah Feb 12 '16 at 5:35
  • @magentotwo When I logged into the backend – Alan Storm Feb 12 '16 at 7:29
11

This check says that anyone can access to app/etc/* files. For example the app/etc/env.php file that stores credentials to DB, crypt key, and other resources.

The better solution is to configure your pub folder as the web root instead of the default installation directory, usually magento2, as specified in most install docs. This will improve overall security and fix you problem. Be sure to edit your other Apache/Nginx location definitions as well. For Nginx, the $MAGE_ROOT directive should be /var/www/example.com/magento2/pub, and so should your root directive. Be sure to flush your cache after making the change as well, otherwise images and css files will be broken (System -> Tools -> Cache Management -> Flush Magento Cache).

\Magento\AdminNotification\Model\System\Message\Security is responsible for this functionality. See the _isFileAccessible method.

It will surely risk Magento store.

3

If you are using Apache, make sure that the .htaccess file that is included with magento in the /app/ folder is present on your web server, and that Apache is configured to use .htaccess files to override settings per folder, but this should be enabled by default.

The content of this file is supposed to be:

<IfVersion < 2.4>
    order allow,deny
    deny from all
</IfVersion>
<IfVersion >= 2.4>
    Require all denied
</IfVersion>
1

It's a system message and this message came from getText() method, class Magento\AdminNotification\Model\System\Message\Security.

When we open the Admin panel the controller checks the all notifications and it's related security.

you can debug from execute() method in Magento\AdminNotification\Controller\Adminhtml\System\Message\ListAction.php.

  • Useful information, but not what I asked. Some code in Magento clearly ran some systems tests and added that message. I want to know where those systems tests are. – Alan Storm Feb 12 '16 at 7:29
1

MAGENTO 2 Centos 7 Server

To fix message "Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider".

1) ### shh- Run the following command from your root account. ###

chown -R accountuser:accountusergroup /path-to-root-folderl/

2) ### ssh - Run the following command from the domain account user(not your web server account such as apache etc). ###

find . -type d -exec chmod 770 {} \; & find . -type f -exec chmod 660 {} \; && chmod u+x bin/magento

chmod -R g+w /path-to-root-folderl/{pub,var} chmod -R g+w /path-to-root-folderl/{app/etc,vendor} chmod -R g+s pub/static pub/media . find var/generation -type d -exec chmod g+s {} \; find var/session -type d -exec chmod g+s {} \;

3) ### ssh - Run the following command from your root account. ###

chown -R domain_account_user:webservergroup /path-to-root-folderl/var chown -R domain_account_user:webservergroup /path-to-root-folder/app/etc chown -R domain_account_user:webservergroup /path-to-root-folderl/pub chown -R webserverUSER:webservergroup /path-to-root-folder/var/session

This will fix this error and many other error. Note: disable SUPHP when using magento 2, you will save yourself a lot of headache. Currently I'm running mod_mpm_event with ea-apache24-mod_cgid and PHP 7 and ea-php70-php-fpm.

I had my magento 2 running with just mod_mpm_event with ea-apache24-mod_cgid and PHP 7 before I added PHP-FPM.

If you are running cpanel/ apache and you don't want to use easyapache to move to mod_mpm_event + ea-apache24-mod_cgid you can use shell from ssh . Run the command bellow from ssh . yum shell remove ea-apache24-mod_mpm_worker remove ea-apache24-mod_cgi install ea-apache24-mod_mpm_event install ea-apache24-mod_cgid run quit

  • that is only going to work on some hosting environments.. could be really bad idea on others – Andy Jun 8 '17 at 18:39
1

In my case the problem was caused by the fact that the default store view was disabled. While the security check was made, the Magento\AdminNotification\Model\System\Message\Security class tried to download the app/etc/config.php file, an exception was thrown (Fatal error: Uncaught Magento\Framework\Exception\NoSuchEntityException: Default store is inactive), which transformed the response code to 200 (normally it should result 404). So the system thought that the file is accessible, which would mean a security issue.

Just enable the default store view to fix this.

0

It's a directory and files permission problem I think. Please give proper permissions like 0755 to directories 0644 to files, if it doesn't solve the issue please check the .htaccess file also.

  • useful information, but not the information I asked for. I want to know where in the Magento core codebase these checks happen. – Alan Storm Feb 12 '16 at 5:07
0

These tests are present inside the class Magento\AdminNotification\Model\System\Message\Security and that notifictaion text comes from function getText() . I think magento checks the accessibilty of app/etc/* files and based on that shows the warning in admin panel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.