Answers.Body: <p>Your proposed solution in your nginx config looks about right; here's a tested &amp; working example:</p>
  
  <pre><code>location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) {
      deny all;
  }
  </code></pre>
  
  <p>Here are some things you could check.</p>
  
  <ol>
  <li><p>Have you reloaded nginx since making the config change?</p></li>
  <li><p>Pick a file in files/civicrm/custom/ and try to access it in a browser.</p>
  
  <ul>
  <li>If you can, the nginx config needs fixing.</li>
  <li>If you can't, the warning is spurious; it would be good to investigate why. Check your nginx access logs for the test requests that Civi makes to check access.</li>
  </ul></li>
  <li><p>Is another <code>location</code> block in your nginx config taking precedence over this one? You can check this by temporarily enabling debug-level logging for the relevant virtual host, e.g.</p>
  
  <p>error_log /path/to/log debug;</p></li>
  </ol>
  
  <p>(Note that nginx needs to have been built with --with-debug .)
  This will produce very verbose logging, so only enable it briefly while testing: enable debug, access a file under files/civicrm/custom/ , disable debug, then look through your error log for the request. From this, you should be able to see which <code>location</code> block matched the request.</p>
  
  <p>You should also deny access to ConfigAndLog/ and templates_c/ as in the config above.</p>
  
  <p>See <a href="http://wiki.civicrm.org/confluence/display/CRMDOC/checkUploadsAreNotAccessible" rel="nofollow">checkUploadsAreNotAccessible</a>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-07-20T11:57:14.050Z
Answers.Text: thanks. it's working. I tested it as well. One gotcha here though. This config should be on top of the other. Since I had location directive set for `*.jpg` files to expire max and I was able to browse jpg files under upload directory. now that I have set this on top (below root) this is working fine now. :) Thanks much.
Answers.UserDisplayName: shrish
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-05T23:15:05.333Z
Answers.Text: Is there a way to correct this issue without configuring nginx? I am hosting on pantheon and don't have access to nginx configs
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-06T09:10:20.290Z
Answers.Text: @YossiCrm Not that I know of. Nginx doesn't use .htaccess files, which are used to configure Civi's per-directory access restrictions under Apache.
Answers.UserDisplayName: davejenx
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-07-20T11:33:02.317Z
Answers.LastActivityDate: 2015-07-20T11:33:02.317Z
Answers.UserDisplayName: davejenx
Body: <p>I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not able to fix it.  </p>
  
  <pre><code>Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/custom/) should not be downloadable.
  
  Read more about this warning
  
  Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/upload/) should not be downloadable.
  
  Read more about this warning
  </code></pre>
  
  <p>I have tried this on my nginx configuration file.</p>
  
  <pre><code>    root /home/drupal7;
  
      location ~ /sites/example.org/files/civicrm/(custom|upload) {
          deny all;
          return 404;
      }
  </code></pre>
  
Tags: <drupal><security><nginx>
Title: Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)
ThreadText: # Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)
  
  (Asked by: username_0 on 2015-07-20)
  
  I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not able to fix it.
  
  ```
  Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/custom/) should not be downloadable.
  
  Read more about this warning
  
  Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/upload/) should not be downloadable.
  
  Read more about this warning
  
  ```
  
  I have tried this on my nginx configuration file.
  
  ```
      root /home/drupal7;
  
      location ~ /sites/example.org/files/civicrm/(custom|upload) {
          deny all;
          return 404;
      }
  
  ```
  
  **Tags:** drupal, security, nginx
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-07-20. Score: 3 | Accepted answer
  
  Your proposed solution in your nginx config looks about right; here's a tested & working example:
  
  ```
  location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) {
      deny all;
  }
  
  ```
  
  Here are some things you could check.
  
  1. Have you reloaded nginx since making the config change?
  2. Pick a file in files/civicrm/custom/ and try to access it in a browser.
  
     * If you can, the nginx config needs fixing.
     * If you can't, the warning is spurious; it would be good to investigate why. Check your nginx access logs for the test requests that Civi makes to check access.
  3. Is another `location` block in your nginx config taking precedence over this one? You can check this by temporarily enabling debug-level logging for the relevant virtual host, e.g.
  
     error\_log /path/to/log debug;
  
  (Note that nginx needs to have been built with --with-debug .)
  This will produce very verbose logging, so only enable it briefly while testing: enable debug, access a file under files/civicrm/custom/ , disable debug, then look through your error log for the request. From this, you should be able to see which `location` block matched the request.
  
  You should also deny access to ConfigAndLog/ and templates\_c/ as in the config above.
  
  See [checkUploadsAreNotAccessible](http://wiki.civicrm.org/confluence/display/CRMDOC/checkUploadsAreNotAccessible).
  
  > **Comments:**
  > **username_0**: thanks. it's working. I tested it as well. One gotcha here though. This config should be on top of the other. Since I had location directive set for `*.jpg` files to expire max and I was able to browse jpg files under upload directory. now that I have set this on top (below root) this is working fine now. :) Thanks much.  
  > **username_2**: Is there a way to correct this issue without configuring nginx? I am hosting on pantheon and don't have access to nginx configs  
  > **username_1**: @YossiCrm Not that I know of. Nginx doesn't use .htaccess files, which are used to configure Civi's per-directory access restrictions under Apache.  
  
  ---
  
  