Answers.Body: <p>For {$display_name}, this was changed in the template two years ago. Can you revert the template to the default to get the updated version? Of if you have customizations, you'll want to apply them to the updated template.</p>
  <p>For the access issues, these should be covered by .htaccess files in those directories. Can you check that those files are present and if so, what the contents are?</p>
  <p>The .htaccess files should contain:</p>
  <pre><code>&lt;Files &quot;*&quot;&gt;
  # OpenLiteSpeed 1.4.38+
    &lt;IfModule !authz_core_module&gt;
      RewriteRule .* - [F,L]
    &lt;/IfModule&gt;
  
  # Apache 2.2
    &lt;IfModule !authz_core_module&gt;
      Order allow,deny
      Deny from all
    &lt;/IfModule&gt;
  
  # Apache 2.4+
    &lt;IfModule authz_core_module&gt;
      Require all denied
    &lt;/IfModule&gt;
  &lt;/Files&gt;
  </code></pre>
  <p>The debug log is the ConfigAndLog folder in the same place as the upload and custom folders.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-20T18:48:33.983Z
Answers.Text: Thanks for the reply, I have checked we don't have .htaccess file in those directories.
Answers.UserDisplayName: Learn CiviCRM
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-20T19:10:46.947Z
Answers.Text: You can add the .htaccess files with the details I added above.
Answers.UserDisplayName: Lars SG
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-21T22:23:39.413Z
Answers.Text: Is the webserver apache? If it's nginx then .htaccess won't work and you'll need to configure it differently.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-22T15:21:12.457Z
Answers.Text: Thanks Lars SG and Demerit. Our server is apach2 not nginx, the .htaccess is under /var/www/html/wordpress, is it if we include the above, the warning should be solved? our testing machine is WSL which is using nginx, can you let ss know how to solve it? Thanks to both of you.
Answers.UserDisplayName: Learn CiviCRM
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-22T16:26:23.000Z
Answers.Text: For apache, you need those .htaccess files in the specific folders. You don't want to add to the .htaccess in the wordpress folder - you won't like the results of that (this prevents access from everyone)!
Answers.UserDisplayName: Lars SG
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-22T19:57:26.163Z
Answers.Text: I have included above in .htaccess under /var/www/html/wordpress/wp-content/uploads/civicrm/upload and refresh Apache, the same warning still appeared in the System Status. Thanks
Answers.UserDisplayName: Learn CiviCRM
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-22T22:57:22.503Z
Answers.Text: I'd make sure you cleared the cache in CiviCRM too. If not, see if you can actually download a file from that folder through your browser.
Answers.UserDisplayName: Lars SG
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-23T14:27:58.973Z
Answers.Text: Thanks Lars SG. I am totally new to this, is it you mean in the browser try to locate IP Address/var/www/html/wordpress/wp-content/uploads/civicrm/upload, if it said NOT FOUND, then it is ok, right? Thanks
Answers.UserDisplayName: Learn CiviCRM
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-23T15:00:24.727Z
Answers.Text: try youdomain.com/wp-content/uploads/civicrm/upload/aspecificfile that you know is there.
Answers.UserDisplayName: Lars SG
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-23T20:28:28.887Z
Answers.Text: I have tried mydomain.com//wordpress/wp-content/uploads/civicrm/ConfigAndLog, and I can open the file CiviCRM.40b48af823f2677bd7e2430d.log, and the .htaccess file is in the same directory with the same content that you suggested. Many Thanks.
Answers.UserDisplayName: Learn CiviCRM
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-23T21:08:04.567Z
Answers.Text: Sounds like you must have some kind of different access control configuration that doesn't use .htaccess (like a Bitnami package, for example). You'll need to figure out the settings for your particular server and configure appropriately to block access to those folders.
Answers.UserDisplayName: Lars SG
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-24T13:17:31.387Z
Answers.Text: I have added the following in apache2.conf, I don't see the files anymore and the warning from CiviCRM is gone. Thanks a lot.                                                    
   <Directory "/var/www/html/wordpress/wp-content/uploads/civicrm/ConfigAndLog">
      AllowOverride All
  </Directory>
Answers.UserDisplayName: Learn CiviCRM
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-08-20T17:29:19.420Z
Answers.LastActivityDate: 2023-08-20T19:10:07.460Z
Answers.LastEditDate: 2023-08-20T19:10:07.460Z
Answers.UserDisplayName: Lars SG
Body: <p>Can you please give your suggestions to help to solve the following system status warning?</p>
  <p>(1) The CiviCRM debug log should not be downloadable.</p>
  <p>(2) Files in the data directory (/var/www/html/wordpress/wp-content/uploads/civicrm/upload/) should not be downloadable.</p>
  <p>(3) Files in the data directory (/var/www/html/wordpress/wp-content/uploads/civicrm/custom/) should not be downloadable.</p>
  <p>(4) Outdated tokens in use - Please review your contribution_invoice_receipt message template and remove references to the token {$display_name} as it has been replaced by {contact.display_name}.</p>
  <p>For (1),(2),and (3), can we solve the problem by setting the directory using ckmod 700? Many Thanks!</p>
  
Tags: <system-status>
Title: CiviCRM System Status warning
ThreadText: # CiviCRM System Status warning
  
  (Asked by: username_0 on 2023-08-20)
  
  Can you please give your suggestions to help to solve the following system status warning?
  
  (1) The username_0 debug log should not be downloadable.
  
  (2) Files in the data directory (/var/www/html/wordpress/wp-content/uploads/username_0/upload/) should not be downloadable.
  
  (3) Files in the data directory (/var/www/html/wordpress/wp-content/uploads/username_0/custom/) should not be downloadable.
  
  (4) Outdated tokens in use - Please review your contribution\_invoice\_receipt message template and remove references to the token {$display\_name} as it has been replaced by {contact.display\_name}.
  
  For (1),(2),and (3), can we solve the problem by setting the directory using ckmod 700? Many Thanks!
  
  **Tags:** system-status
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-08-20. Score: 4
  
  For {$display\_name}, this was changed in the template two years ago. Can you revert the template to the default to get the updated version? Of if you have customizations, you'll want to apply them to the updated template.
  
  For the access issues, these should be covered by .htaccess files in those directories. Can you check that those files are present and if so, what the contents are?
  
  The .htaccess files should contain:
  
  ```
  <Files "*">
  # OpenLiteSpeed 1.4.38+
    <IfModule !authz_core_module>
      RewriteRule .* - [F,L]
    </IfModule>
  
  # Apache 2.2
    <IfModule !authz_core_module>
      Order allow,deny
      Deny from all
    </IfModule>
  
  # Apache 2.4+
    <IfModule authz_core_module>
      Require all denied
    </IfModule>
  </Files>
  
  ```
  
  The debug log is the ConfigAndLog folder in the same place as the upload and custom folders.
  
  > **Comments:**
  > **username_0**: Thanks for the reply, I have checked we don't have .htaccess file in those directories.  
  > **username_1**: You can add the .htaccess files with the details I added above.  
  > **username_2**: Is the webserver apache? If it's nginx then .htaccess won't work and you'll need to configure it differently.  
  > **username_0**: Thanks username_1 and username_2. Our server is apach2 not nginx, the .htaccess is under /var/www/html/wordpress, is it if we include the above, the warning should be solved? our testing machine is WSL which is using nginx, can you let ss know how to solve it? Thanks to both of you.  
  > **username_1**: For apache, you need those .htaccess files in the specific folders. You don't want to add to the .htaccess in the wordpress folder - you won't like the results of that (this prevents access from everyone)!  
  > **username_0**: I have included above in .htaccess under /var/www/html/wordpress/wp-content/uploads/username_0/upload and refresh Apache, the same warning still appeared in the System Status. Thanks  
  > **username_1**: I'd make sure you cleared the cache in username_0 too. If not, see if you can actually download a file from that folder through your browser.  
  > **username_0**: Thanks username_1. I am totally new to this, is it you mean in the browser try to locate IP Address/var/www/html/wordpress/wp-content/uploads/username_0/upload, if it said NOT FOUND, then it is ok, right? Thanks  
  > **username_1**: try youdomain.com/wp-content/uploads/username_0/upload/aspecificfile that you know is there.  
  > **username_0**: I have tried mydomain.com//wordpress/wp-content/uploads/username_0/ConfigAndLog, and I can open the file username_0.40b48af823f2677bd7e2430d.log, and the .htaccess file is in the same directory with the same content that you suggested. Many Thanks.  
  > **username_1**: Sounds like you must have some kind of different access control configuration that doesn't use .htaccess (like a Bitnami package, for example). You'll need to figure out the settings for your particular server and configure appropriately to block access to those folders.  
  > **username_0**: I have added the following in apache2.conf, I don't see the files anymore and the warning from username_0 is gone. Thanks a lot.                                                      <Directory "/var/www/html/wordpress/wp-content/uploads/username_0/ConfigAndLog">     AllowOverride All </Directory>  
  
  ---
  
  