19

My Magento 2 development environment has started poking me with the following error message

Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider

Has anyone tracked down

  1. What security checks are happening?
  2. Where in the core code these checks happen?
Improve this question
  • can u please tell me which version of 2,you have use – Amit Bera♦ Feb 12 '16 at 5:16
  • @AmitBera With individual packages being composer repositories I'm not really sure how to check that – Alan Storm Feb 12 '16 at 5:17
  • 1
    @AlanStorm, this message came from Magento\AdminNotification\Model\System\Message\Security class. which situation you got this message? – Bojjaiah Feb 12 '16 at 5:35
  • @magentotwo When I logged into the backend – Alan Storm Feb 12 '16 at 7:29

11 Answers 11

Active Oldest Votes
15

This check says that anyone can access to app/etc/* files. For example the app/etc/env.php file that stores credentials to DB, crypt key, and other resources.

The better solution is to configure your pub folder as the web root instead of the default installation directory, usually magento2, as specified in most install docs. This will improve overall security and fix you problem. Be sure to edit your other Apache/Nginx location definitions as well. For Nginx, the $MAGE_ROOT directive should be /var/www/example.com/magento2/pub, and so should your root directive. Be sure to flush your cache after making the change as well, otherwise images and css files will be broken (System -> Tools -> Cache Management -> Flush Magento Cache).

\Magento\AdminNotification\Model\System\Message\Security is responsible for this functionality. See the _isFileAccessible method.

It will surely risk Magento store.

Improve this answer
3

If you are using Apache, make sure that the .htaccess file that is included with magento in the /app/ folder is present on your web server, and that Apache is configured to use .htaccess files to override settings per folder, but this should be enabled by default.

The content of this file is supposed to be:

<IfVersion < 2.4>
    order allow,deny
    deny from all
</IfVersion>
<IfVersion >= 2.4>
    Require all denied
</IfVersion>
Improve this answer
1

It's a system message and this message came from getText() method, class Magento\AdminNotification\Model\System\Message\Security.

When we open the Admin panel the controller checks the all notifications and it's related security.

you can debug from execute() method in Magento\AdminNotification\Controller\Adminhtml\System\Message\ListAction.php.

Improve this answer
  • Useful information, but not what I asked. Some code in Magento clearly ran some systems tests and added that message. I want to know where those systems tests are. – Alan Storm Feb 12 '16 at 7:29
1

MAGENTO 2 Centos 7 Server

To fix message "Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider".

1) ### shh- Run the following command from your root account. ###

chown -R accountuser:accountusergroup /path-to-root-folderl/

2) ### ssh - Run the following command from the domain account user(not your web server account such as apache etc). ###

find . -type d -exec chmod 770 {} \; & find . -type f -exec chmod 660 {} \; && chmod u+x bin/magento

chmod -R g+w /path-to-root-folderl/{pub,var} chmod -R g+w /path-to-root-folderl/{app/etc,vendor} chmod -R g+s pub/static pub/media . find var/generation -type d -exec chmod g+s {} \; find var/session -type d -exec chmod g+s {} \;

3) ### ssh - Run the following command from your root account. ###

chown -R domain_account_user:webservergroup /path-to-root-folderl/var chown -R domain_account_user:webservergroup /path-to-root-folder/app/etc chown -R domain_account_user:webservergroup /path-to-root-folderl/pub chown -R webserverUSER:webservergroup /path-to-root-folder/var/session

This will fix this error and many other error. Note: disable SUPHP when using magento 2, you will save yourself a lot of headache. Currently I'm running mod_mpm_event with ea-apache24-mod_cgid and PHP 7 and ea-php70-php-fpm.

I had my magento 2 running with just mod_mpm_event with ea-apache24-mod_cgid and PHP 7 before I added PHP-FPM.

If you are running cpanel/ apache and you don't want to use easyapache to move to mod_mpm_event + ea-apache24-mod_cgid you can use shell from ssh . Run the command bellow from ssh . yum shell remove ea-apache24-mod_mpm_worker remove ea-apache24-mod_cgi install ea-apache24-mod_mpm_event install ea-apache24-mod_cgid run quit

Improve this answer
  • that is only going to work on some hosting environments.. could be really bad idea on others – Andy Jun 8 '17 at 18:39
1

In my case the problem was caused by the fact that the default store view was disabled. While the security check was made, the Magento\AdminNotification\Model\System\Message\Security class tried to download the app/etc/config.php file, an exception was thrown (Fatal error: Uncaught Magento\Framework\Exception\NoSuchEntityException: Default store is inactive), which transformed the response code to 200 (normally it should result 404). So the system thought that the file is accessible, which would mean a security issue.

Just enable the default store view to fix this.

Improve this answer
1

One easy solution is, if you are not using nginx, than rename nginx.conf file to 'nginx.conf.sample' in root directory of your magento installation. This worked for me, and the warning message disappear in Magento Admin.

Improve this answer
1

You need to do few things

  1. Change your site URL from HTTP to HTTPS from admin
  2. Change app/etc/config.php file permission to 660

If not showing yet, clear the cache with

php bin/magento c:c && php bin/magento c:f

  1. Now change the append below code to the app/etc/env.php

    'directories' => [ 'document_root_is_pub' => true ]

  2. Now switch the mode to production

    bin/magento deploy:mode:set production

    bin/magento cache:flush

  3. Now switch back to developer mode

    bin/magento deploy:mode:set developer

    bin/magento cache:flush

Now check your store front-end and make sure it is working.

Improve this answer
0

It's a directory and files permission problem I think. Please give proper permissions like 0755 to directories 0644 to files, if it doesn't solve the issue please check the .htaccess file also.

Improve this answer
  • useful information, but not the information I asked for. I want to know where in the Magento core codebase these checks happen. – Alan Storm Feb 12 '16 at 5:07
0

These tests are present inside the class Magento\AdminNotification\Model\System\Message\Security and that notifictaion text comes from function getText() . I think magento checks the accessibilty of app/etc/* files and based on that shows the warning in admin panel.

Improve this answer
0

I got the message from the fact that I did not yet set up HTTP to HTTPS redirect.

Nginx 

server {
    listen      80;
    server_name example.com;
    #Rewrite all nonssl requests to ssl.
    return 301 https://$host$request_uri;
}

Apache 

<VirtualHost *:80>
ServerName example.com
Redirect permanent / https://example.com/
</VirtualHost>

see this for the http check. If http returns a 200 status code you'll get this message.

Improve this answer
0

Magento ver. 2.3.5-p1 none of the above works for me.

Create a .htaccess file inside app/etc/ folder and add the following code:

Order deny,allow
Deny from all
RewriteRule ^(.*)config.php$ - [F,L]
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.