Answers.Body: <p>Your proposed solution in your nginx config looks about right; here's a tested &amp; working example:</p>
  
  <pre><code>location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) {
      deny all;
  }
  </code></pre>
  
  <p>Here are some things you could check.</p>
  
  <ol>
  <li><p>Have you reloaded nginx since making the config change?</p></li>
  <li><p>Pick a file in files/civicrm/custom/ and try to access it in a browser.</p>
  
  <ul>
  <li>If you can, the nginx config needs fixing.</li>
  <li>If you can't, the warning is spurious; it would be good to investigate why. Check your nginx access logs for the test requests that Civi makes to check access.</li>
  </ul></li>
  <li><p>Is another <code>location</code> block in your nginx config taking precedence over this one? You can check this by temporarily enabling debug-level logging for the relevant virtual host, e.g.</p>
  
  <p>error_log /path/to/log debug;</p></li>
  </ol>
  
  <p>(Note that nginx needs to have been built with --with-debug .)
  This will produce very verbose logging, so only enable it briefly while testing: enable debug, access a file under files/civicrm/custom/ , disable debug, then look through your error log for the request. From this, you should be able to see which <code>location</code> block matched the request.</p>
  
  <p>You should also deny access to ConfigAndLog/ and templates_c/ as in the config above.</p>
  
  <p>See <a href="http://wiki.civicrm.org/confluence/display/CRMDOC/checkUploadsAreNotAccessible" rel="nofollow">checkUploadsAreNotAccessible</a>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-07-20T11:57:14.050Z
Answers.Text: thanks. it's working. I tested it as well. One gotcha here though. This config should be on top of the other. Since I had location directive set for `*.jpg` files to expire max and I was able to browse jpg files under upload directory. now that I have set this on top (below root) this is working fine now. :) Thanks much.
Answers.UserDisplayName: shrish
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-05T23:15:05.333Z
Answers.Text: Is there a way to correct this issue without configuring nginx? I am hosting on pantheon and don't have access to nginx configs
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-06T09:10:20.290Z
Answers.Text: @YossiCrm Not that I know of. Nginx doesn't use .htaccess files, which are used to configure Civi's per-directory access restrictions under Apache.
Answers.UserDisplayName: davejenx
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-07-20T11:33:02.317Z
Answers.LastActivityDate: 2015-07-20T11:33:02.317Z
Answers.UserDisplayName: davejenx
Body: <p>I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not able to fix it.  </p>
  
  <pre><code>Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/custom/) should not be downloadable.
  
  Read more about this warning
  
  Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/upload/) should not be downloadable.
  
  Read more about this warning
  </code></pre>
  
  <p>I have tried this on my nginx configuration file.</p>
  
  <pre><code>    root /home/drupal7;
  
      location ~ /sites/example.org/files/civicrm/(custom|upload) {
          deny all;
          return 404;
      }
  </code></pre>
  
Tags: <drupal><security><nginx>
Title: Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)
ThreadText: # Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)
  
  (Asked by: username_0 on 2015-07-20)
  
  I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not able to fix it.  
  Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/custom/) should not be downloadable.
  
  Read more about this warning
  
  Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/upload/) should not be downloadable.
  
  Read more about this warning
  
  I have tried this on my nginx configuration file.
      root /home/drupal7;
  
      location ~ /sites/example.org/files/civicrm/(custom|upload) {
          deny all;
          return 404;
      }
  
  **Tags:** drupal, security, nginx
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-07-20. Score: 3 | Accepted answer
  
  Your proposed solution in your nginx config looks about right; here's a tested & working example:
  location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) {
      deny all;
  }
  
  Here are some things you could check.
  
  Have you reloaded nginx since making the config change?
  Pick a file in files/civicrm/custom/ and try to access it in a browser.
  
  If you can, the nginx config needs fixing.
  If you can't, the warning is spurious; it would be good to investigate why. Check your nginx access logs for the test requests that Civi makes to check access.
  
  Is another location block in your nginx config taking precedence over this one? You can check this by temporarily enabling debug-level logging for the relevant virtual host, e.g.
  error_log /path/to/log debug;
  
  (Note that nginx needs to have been built with --with-debug .)
  This will produce very verbose logging, so only enable it briefly while testing: enable debug, access a file under files/civicrm/custom/ , disable debug, then look through your error log for the request. From this, you should be able to see which location block matched the request.
  You should also deny access to ConfigAndLog/ and templates_c/ as in the config above.
  See checkUploadsAreNotAccessible.
  
  > **Comments:**
  > **username_0**: thanks. it's working. I tested it as well. One gotcha here though. This config should be on top of the other. Since I had location directive set for `*.jpg` files to expire max and I was able to browse jpg files under upload directory. now that I have set this on top (below root) this is working fine now. :) Thanks much.  
  > **username_2**: Is there a way to correct this issue without configuring nginx? I am hosting on pantheon and don't have access to nginx configs  
  > **username_1**: @username_2Crm Not that I know of. Nginx doesn't use .htaccess files, which are used to configure Civi's per-directory access restrictions under Apache.  
  
  ---
  
  