{"action":"opened","issue":{"url":"https://api.github.com/repos/pantheon-systems/documentation/issues/3838","repository_url":"https://api.github.com/repos/pantheon-systems/documentation","labels_url":"https://api.github.com/repos/pantheon-systems/documentation/issues/3838/labels{/name}","comments_url":"https://api.github.com/repos/pantheon-systems/documentation/issues/3838/comments","events_url":"https://api.github.com/repos/pantheon-systems/documentation/issues/3838/events","html_url":"https://github.com/pantheon-systems/documentation/issues/3838","id":336937224,"node_id":"MDU6SXNzdWUzMzY5MzcyMjQ=","number":3838,"title":"Document \"not fully protected\" public directory (Drupal)","user":{"login":"tinefin","id":333029,"node_id":"MDQ6VXNlcjMzMzAyOQ==","avatar_url":"https://avatars0.githubusercontent.com/u/333029?v=4","gravatar_id":"","url":"https://api.github.com/users/tinefin","html_url":"https://github.com/tinefin","followers_url":"https://api.github.com/users/tinefin/followers","following_url":"https://api.github.com/users/tinefin/following{/other_user}","gists_url":"https://api.github.com/users/tinefin/gists{/gist_id}","starred_url":"https://api.github.com/users/tinefin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tinefin/subscriptions","organizations_url":"https://api.github.com/users/tinefin/orgs","repos_url":"https://api.github.com/users/tinefin/repos","events_url":"https://api.github.com/users/tinefin/events{/privacy}","received_events_url":"https://api.github.com/users/tinefin/received_events","type":"User","site_admin":false},"labels":[{"id":200891065,"node_id":"MDU6TGFiZWwyMDA4OTEwNjU=","url":"https://api.github.com/repos/pantheon-systems/documentation/labels/new%20doc","name":"new doc","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-29T09:54:51Z","updated_at":"2018-06-29T09:54:51Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"We regularly see tickets due to Drupal reporting public / tmp directory \"not fully protected\". This happens in D7 and D8.\r\n\r\nThe reason is that Drupal expects to find a .htaccess file protecting these directories, as per:\r\nhttps://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2013-11-20/sa-core-2013-003-drupal-core\r\n\r\nQuoting from there:\r\n\r\n> Please note that if you are using a different web server such as Nginx the .htaccess files have no effect and you need to configure PHP execution protection yourself in the respective server configuration files.\r\n\r\nOn Pantheon we have implemented the needed protection on Nginx level, so this is a false alert.\r\n\r\nDO issue pending on this:\r\nhttps://www.drupal.org/project/drupal/issues/2150399\r\n\r\nInternal reference:\r\nhttps://pantheon-systems.desk.com/agent/case/108617"}}
{"actor":{"display_login":"tinefin"}}