Answers.Body: <p>Your <code>.htaccess</code> file is incorrect.</p>
  
  <p>It should contain the following content:</p>
  
  
  
  <pre><code>
  # Turn off all options we don't need.
  Options -Indexes -ExecCGI -Includes -MultiViews
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  &lt;Files *&gt;
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  &lt;/Files&gt;
  # If we know how to do it safely, disable the PHP engine entirely.
  &lt;IfModule mod_php5.c&gt;
    php_flag engine off
  &lt;/IfModule&gt;
  
  </code></pre>
  
  <p>The remaining lines are added ONLY for private file storage, namely these lines:</p>
  
  
  
  <pre><code># Deny all requests from Apache 2.4+.
  &lt;IfModule mod_authz_core.c&gt;
    Require all denied
  &lt;/IfModule&gt;
  # Deny all requests from Apache 2.0-2.2.
  &lt;IfModule !mod_authz_core.c&gt;
    Deny from all
  &lt;/IfModule&gt;
  </code></pre>
  
  <p><strong>You should check your Drupal configuration, to ensure that you have a separate folder configured for private file storage, this should be outside your web root.</strong></p>
  
  <p>You should check your configuration against the Drupal documentation here: <a href="https://www.drupal.org/docs/7/install/setting-up-the-files-directory" rel="nofollow noreferrer">https://www.drupal.org/docs/7/install/setting-up-the-files-directory</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:45:36.993Z
Answers.Text: I will try that. Thank you. I am trying to understand why I need to have a separate folder configured for private file storage outside my web root. I don't see in https://www.drupal.org/docs/7/install/setting-up-the-files-directory anything in relation to that.
Answers.UserDisplayName: Pierre François
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:46:59.947Z
Answers.Text: The entire point of your private files folder is that it's private (i.e. not in your public files path). It is used for files that are delivered via PHP/Drupal and not via the web server.
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:47:23.810Z
Answers.Text: See this issue: https://www.drupal.org/project/documentation/issues/1006692
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:50:10.253Z
Answers.Text: This blog is useful as well: https://openconcept.ca/blog/mgifford/setting-drupal-7s-private-file-system
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:53:47.133Z
Answers.Text: OK. I understood that I don't need private files for now. The `.htaccess` that works for me is containing only the first part of the two ones that you posted in your answer.
Answers.UserDisplayName: Pierre François
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:59:58.197Z
Answers.Text: Make sure you turn off (clear!) the private files path in Drupal settings - otherwise Drupal will helpfully recreate the .htaccess it thinks should be there!
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T19:03:27.130Z
Answers.Text: It was not true I didn't need private files. I did for the module Backup and Migrate, but thanks to the hints I found here, I could manage it to make the module save the backups in a directory outside of the Drupal tree. This is an advantage because the backups now go directly to a directory that is synchronised with the cloud.
Answers.UserDisplayName: Pierre François
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T12:57:07.933Z
Answers.LastActivityDate: 2020-06-09T12:57:07.933Z
Answers.UserDisplayName: HomoTechsual
Body: <p>My CiviCRM menu bar doesn't appear at the right place on the page and its stylesheet is not loading. </p>
  
  <p>I have the same symptoms as in question <a href="https://civicrm.stackexchange.com/questions/30547/menu-problem-with-civicrm-5-13-2">Menu Problem with CiviCRM 5.13.2</a> but the solutions they offer there do not solve my issue.</p>
  
  <p>Since the picture of the heading at <code>http://***.be/sites/default/files/ocsr.png</code> doesn't show up, I discovered that the files under the directory <code>&lt;drupal_root&gt;/sites/default/files</code> are not served anymore by <code>apache</code> when requested by the browser.</p>
  
  <p>There is a <code>.htaccess</code> file in that directory containing:</p>
  
  <pre><code># Deny all requests from Apache 2.4+.
  &lt;IfModule mod_authz_core.c&gt;
    Require all denied
  &lt;/IfModule&gt;
  
  # Deny all requests from Apache 2.0-2.2.
  &lt;IfModule !mod_authz_core.c&gt;
    Deny from all
  &lt;/IfModule&gt;
  
  # Turn off all options we don't need.
  Options None
  Options +FollowSymLinks
  
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  &lt;Files *&gt;
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  &lt;/Files&gt;
  
  # If we know how to do it safely, disable the PHP engine entirely.
  &lt;IfModule mod_php5.c&gt;
    php_flag engine off
  &lt;/IfModule&gt;
  &lt;IfModule mod_php7.c&gt;
    php_flag engine off
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>My knowledge of <code>apache</code> is too poor to understand if this file is the guilty, but in the logs of <code>apache</code>, I see entries as:</p>
  
  <pre><code>[Tue Jun 09 14:18:54.299253 2020] [authz_core:error] [pid 30658] [client 127.0.0.1:42982] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/civicrm/persist/contribute/dyn/crm-menubar.4153687684a8323812edc1dc3cdbefbd.css
  [Tue Jun 09 14:38:46.732818 2020] [authz_core:error] [pid 22455] [client 127.0.0.1:43090] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/ocsr.png
  </code></pre>
  
  <p>that seem to be connected directly with my issue. </p>
  
  <p>Since I am a newbie with CiviCRM, I don't have any clue about how to solve this. </p>
  
  <p>Perhaps another useful information: I didn't have time to upgrade to the last version of Drupal 7 up to now. I don't know if the problem is coming from that delay and I don't know what is better: first solve the issue and then upgrade, or the contrary.</p>
  
Tags: <drupal>
Title: Menu Problem with CiviCRM 5.26.0 in Drupal
ThreadText: # Menu Problem with CiviCRM 5.26.0 in Drupal
  
  (Asked by: username_0 on 2020-06-09)
  
  My CiviCRM menu bar doesn't appear at the right place on the page and its stylesheet is not loading.
  
  I have the same symptoms as in question [Menu Problem with CiviCRM 5.13.2](https://civicrm.stackexchange.com/questions/30547/menu-problem-with-civicrm-5-13-2) but the solutions they offer there do not solve my issue.
  
  Since the picture of the heading at `http://***.be/sites/default/files/ocsr.png` doesn't show up, I discovered that the files under the directory `<drupal_root>/sites/default/files` are not served anymore by `apache` when requested by the browser.
  
  There is a `.htaccess` file in that directory containing:
  
  ```
  # Deny all requests from Apache 2.4+.
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  
  # Deny all requests from Apache 2.0-2.2.
  <IfModule !mod_authz_core.c>
    Deny from all
  </IfModule>
  
  # Turn off all options we don't need.
  Options None
  Options +FollowSymLinks
  
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  <Files *>
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  </Files>
  
  # If we know how to do it safely, disable the PHP engine entirely.
  <IfModule mod_php5.c>
    php_flag engine off
  </IfModule>
  <IfModule mod_php7.c>
    php_flag engine off
  </IfModule>
  
  ```
  
  My knowledge of `apache` is too poor to understand if this file is the guilty, but in the logs of `apache`, I see entries as:
  
  ```
  [Tue Jun 09 14:18:54.299253 2020] [authz_core:error] [pid 30658] [client 127.0.0.1:42982] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/civicrm/persist/contribute/dyn/crm-menubar.4153687684a8323812edc1dc3cdbefbd.css
  [Tue Jun 09 14:38:46.732818 2020] [authz_core:error] [pid 22455] [client 127.0.0.1:43090] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/ocsr.png
  
  ```
  
  that seem to be connected directly with my issue.
  
  Since I am a newbie with CiviCRM, I don't have any clue about how to solve this.
  
  Perhaps another useful information: I didn't have time to upgrade to the last version of Drupal 7 up to now. I don't know if the problem is coming from that delay and I don't know what is better: first solve the issue and then upgrade, or the contrary.
  
  **Tags:** drupal
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-06-09. Score: 1 | Accepted answer
  
  Your `.htaccess` file is incorrect.
  
  It should contain the following content:
  
  ```
  
  # Turn off all options we don't need.
  Options -Indexes -ExecCGI -Includes -MultiViews
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  <Files *>
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  </Files>
  # If we know how to do it safely, disable the PHP engine entirely.
  <IfModule mod_php5.c>
    php_flag engine off
  </IfModule>
  
  ```
  
  The remaining lines are added ONLY for private file storage, namely these lines:
  
  ```
  # Deny all requests from Apache 2.4+.
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  # Deny all requests from Apache 2.0-2.2.
  <IfModule !mod_authz_core.c>
    Deny from all
  </IfModule>
  
  ```
  
  **You should check your Drupal configuration, to ensure that you have a separate folder configured for private file storage, this should be outside your web root.**
  
  You should check your configuration against the Drupal documentation here: <https://www.drupal.org/docs/7/install/setting-up-the-files-directory>
  
  > **Comments:**
  > **username_0**: I will try that. Thank you. I am trying to understand why I need to have a separate folder configured for private file storage outside my web root. I don't see in https://www.drupal.org/docs/7/install/setting-up-the-files-directory anything in relation to that.  
  > **username_1**: The entire point of your private files folder is that it's private (i.e. not in your public files path). It is used for files that are delivered via PHP/Drupal and not via the web server.  
  > **username_1**: See this issue: https://www.drupal.org/project/documentation/issues/1006692  
  > **username_1**: This blog is useful as well: https://openconcept.ca/blog/mgifford/setting-drupal-7s-private-file-system  
  > **username_0**: OK. I understood that I don't need private files for now. The `.htaccess` that works for me is containing only the first part of the two ones that you posted in your answer.  
  > **username_1**: Make sure you turn off (clear!) the private files path in Drupal settings - otherwise Drupal will helpfully recreate the .htaccess it thinks should be there!  
  > **username_0**: It was not true I didn't need private files. I did for the module Backup and Migrate, but thanks to the hints I found here, I could manage it to make the module save the backups in a directory outside of the Drupal tree. This is an advantage because the backups now go directly to a directory that is synchronised with the cloud.  
  
  ---
  
  