Answers.Body: <p>I have discovered that the <code>delete-this</code> files are temporary files created by CiviCRM for the sole purpose of generating this error! This error is <strong>good</strong>, it means that these directories are not browseable, and they shouldn't be browseable.</p>
  
  <p>CiviCRM's <code>CRM_Utils_Check_Security</code> class does these checks in order to report what would-be security errors.</p>
  
  <p>It creates a file, then tries to access that file via http. This should fail.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T00:22:25.477Z
Answers.Text: Civi's security-checking functions also make sure that the debug log (`ConfigAndLog.xxxxxxxxxxxxxxxxxxxxxxxx.log`) is not web-accessible. See this related question: https://civicrm.stackexchange.com/questions/11918/howto-fix-client-denied-by-server-configuration?noredirect=1&lq=1
Answers.UserDisplayName: Noah Miller
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T09:33:27.463Z
Answers.LastActivityDate: 2015-12-14T09:33:27.463Z
Answers.UserDisplayName: artfulrobot
Body: <p>I'm noticing a lot in the logs whereby the server itself is trying to request a resource that CiviCRM denies access to by <code>.htaccess</code>.</p>
  
  <p>Specifically it seems the CiviCRM server is trying to fetch files of this pattern:</p>
  
  <pre><code>/sites/default/files/civicrm/upload/delete-this-d3542fs2sP
  /sites/default/files/civicrm/custom/delete-this-D44i89qZNP
  </code></pre>
  
  <p>Yet both of those directories contain <code>.htaccess</code> files with <code>Deny all</code> statements.</p>
  
  <p>Anyone shed any light on this? [4.4.20 LTS, Drupal 7]</p>
  
Tags: <drupal><logs><lts>
Title: Access denied errors by server itself on uploaded files?
ThreadText: # Access denied errors by server itself on uploaded files?
  
  (Asked by: username_0 on 2015-11-19)
  
  I'm noticing a lot in the logs whereby the server itself is trying to request a resource that CiviCRM denies access to by .htaccess.
  Specifically it seems the CiviCRM server is trying to fetch files of this pattern:
  /sites/default/files/civicrm/upload/delete-this-d3542fs2sP
  /sites/default/files/civicrm/custom/delete-this-D44i89qZNP
  
  Yet both of those directories contain .htaccess files with Deny all statements.
  Anyone shed any light on this? [4.4.20 LTS, Drupal 7]
  
  **Tags:** drupal, logs, lts
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2015-12-14. Score: 4 | Accepted answer
  
  I have discovered that the `delete-this` files are temporary files created by CiviCRM for the sole purpose of generating this error! This error is **good**, it means that these directories are not browseable, and they shouldn't be browseable.
  
  CiviCRM's `CRM_Utils_Check_Security` class does these checks in order to report what would-be security errors.
  
  It creates a file, then tries to access that file via http. This should fail.
  
  > **Comments:**
  > **username_1**: Civi's security-checking functions also make sure that the debug log (`ConfigAndLog.xxxxxxxxxxxxxxxxxxxxxxxx.log`) is not web-accessible. See this related question: https://civicrm.stackexchange.com/questions/11918/howto-fix-client-denied-by-server-configuration?noredirect=1&lq=1  
  
  ---
  
  