Answers.Body: <p>Pantheon allows you to protect (a limited number of) webpaths, using a pantheon.yml file.</p>
  
  <pre><code>protected_web_paths:
    - /example_directory
  </code></pre>
  
  <p>(<a href="https://pantheon.io/docs/pantheon-yml/#protected-web-paths" rel="nofollow noreferrer">https://pantheon.io/docs/pantheon-yml/#protected-web-paths</a>)</p>
  
  <p>It is, in effect, a nginx deny.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-08-04T15:19:49.290Z
Answers.LastActivityDate: 2017-08-04T15:19:49.290Z
Answers.UserDisplayName: user18099
Answers.Body: <p>Thanks @Chris Burgess!
  I went with your recommendation and pushed the edited civi settings file up to pantheon but still got the same warnings. I then went into administer>system settings>directory and noticed that the settings where still pointing to the public files. I then sftp'd into sites/default/private and manually created the same directory names that civi was using in the public files. Then in the GUI I added private/ after files/ for all the upload directories. 
  <a href="https://i.sstatic.net/8dB6V.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/8dB6V.png" alt="enter image description here"></a></p>
  
  <p>Since the code didn't do the trick I reverted to prior settings and everything still works. I'm not getting the security warnings anymore. </p>
  
  <p>UPDATE:
  After @Chris Burgess comment below, we went ahead and added his code mentioned in his answer in civicrm.settings.php. We had to replace the last line with :
  $civicrm_setting['URL Preferences']['userFrameworkResourceURL'] = $base_url . '/sites/all/extensions';</p>
  
  <p>Everything looks good now</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-07T01:39:55.237Z
Answers.Text: You should review [What is required to run CiviCRM on Pantheon?](http://civicrm.stackexchange.com/questions/4464/what-is-required-to-run-civicrm-on-pantheon) which better explains the reason for setting those paths in `civicrm.settings.php` - basically, at some point Pantheon is likely to move your `/srv/bindings/2c6caa...`path, and those settings now stored in your DB will stop working. That's why we load the binding root from `$pantheon_conf['pantheon_binding']` instead.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-07T02:18:40.413Z
Answers.Text: To have the settings change from my answer work, make sure you're matching the context etc so that `$pantheon_conf` actually exists and contains your binding root. See linked issue for full details.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-07T17:23:08.597Z
Answers.Text: Thank @Chris. We pasted your code and everything good. All I did was change the last line to this :
  $civicrm_setting['URL Preferences']['userFrameworkResourceURL'] = $base_url . '/sites/all/extensions';
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-07T00:59:51.730Z
Answers.LastActivityDate: 2015-08-07T17:25:30.153Z
Answers.LastEditDate: 2015-08-07T17:25:30.153Z
Answers.UserDisplayName: Yossi
Answers.Body: <p>Pantheon does not support .htaccess files nor custom location directives, which are the common approaches to protecting those files from access on Apache / Nginx.</p>
  
  <p>However, moving your CiviCRM file directories from <code>sites/default/files/civicrm</code> to <code>sites/default/private/civicrm</code> should resolve this, because Pantheon protects that location out of the box.</p>
  
  <p>See Drupal.org <a href="https://www.drupal.org/node/2195947" rel="nofollow">#2195947 - Security warning from Civi re exposed "files" directory</a> for how this is addressed in CiviCRM StarterKit.</p>
  
  <p>You will need to end up with something like this in your civicrm.settings.php, the linked issue above gives the required context needed to ensure <code>$pantheon_conf</code> contains appropriate values.</p>
  
  <pre><code>  global $civicrm_setting;
    $civicrm_setting['Directory Preferences']['uploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/upload/';
    $civicrm_setting['Directory Preferences']['customFileUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/custom/';
    $civicrm_setting['Directory Preferences']['imageUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/persist/contribute/';
    $civicrm_setting['Directory Preferences']['extensionsDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/code/sites/all/extensions/';
    $civicrm_setting['URL Preferences']['extensionsURL'] = $base_url . '/sites/all/extensions';
  </code></pre>
  
  <p>See also the relevant CiviCRM security advisory, <a href="https://civicrm.org/advisory/civi-sa-2014-001-risk-information-disclosure" rel="nofollow">CIVI-SA-2014-001 Risk of information disclosure</a>. Moving the restricted files outside the webroot entirely would be the ideal solution if/when CiviCRM supports that.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-19T00:51:18.977Z
Answers.Text: The message recently resurfaced even though I did apply those changes to civicrm.settings.php and moved my civicrm files directory from files/civicrm to files/private/civicrm.
  I took a peak into my files directory and found that the civicrm directory was recreated in files/ in addition to the one in files/private. 
  The one that was recreated in files/ contains only a template_c directory and configandlog directory. 
  I looked at the civicrm.settings and found some paths for template_c and changed those to private/ but nothing regarding config and log... any ideas?
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-06T02:03:20.290Z
Answers.LastActivityDate: 2015-08-07T01:37:44.787Z
Answers.LastEditDate: 2015-08-07T01:37:44.787Z
Answers.UserDisplayName: Chris Burgess
Body: <p>Getting Security warning everytime I log into civicrm that my log directory is downloadable. 
  I checked and it is completely viewable on my browser.
  I realize that there is a solution for nginx enviroments however I am running my site on pantheon and do not have access to any nginx configs. 
  Is there something I can do civi-side to fix this?</p>
  
Tags: <security><pantheon>
Title: Security Warning on Dashboard (pantheon / nginx)
ThreadText: # Security Warning on Dashboard (pantheon / nginx)
  
  (Asked by: username_0 on 2015-08-05)
  
  Getting Security warning everytime I log into civicrm that my log directory is downloadable.
  I checked and it is completely viewable on my browser.
  I realize that there is a solution for nginx enviroments however I am running my site on pantheon and do not have access to any nginx configs.
  Is there something I can do civi-side to fix this?
  
  **Tags:** security, pantheon
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2015-08-06. Score: 5 | Accepted answer
  
  Pantheon does not support .htaccess files nor custom location directives, which are the common approaches to protecting those files from access on Apache / Nginx.
  However, moving your CiviCRM file directories from sites/default/files/civicrm to sites/default/private/civicrm should resolve this, because Pantheon protects that location out of the box.
  See Drupal.org #2195947 - Security warning from Civi re exposed "files" directory for how this is addressed in CiviCRM StarterKit.
  You will need to end up with something like this in your civicrm.settings.php, the linked issue above gives the required context needed to ensure $pantheon_conf contains appropriate values.
    global $civicrm_setting;
    $civicrm_setting['Directory Preferences']['uploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/upload/';
    $civicrm_setting['Directory Preferences']['customFileUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/custom/';
    $civicrm_setting['Directory Preferences']['imageUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/persist/contribute/';
    $civicrm_setting['Directory Preferences']['extensionsDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/code/sites/all/extensions/';
    $civicrm_setting['URL Preferences']['extensionsURL'] = $base_url . '/sites/all/extensions';
  
  See also the relevant CiviCRM security advisory, CIVI-SA-2014-001 Risk of information disclosure. Moving the restricted files outside the webroot entirely would be the ideal solution if/when CiviCRM supports that.
  
  > **Comments:**
  > **username_0**: The message recently resurfaced even though I did apply those changes to civicrm.settings.php and moved my civicrm files directory from files/civicrm to files/private/civicrm. I took a peak into my files directory and found that the civicrm directory was recreated in files/ in addition to the one in files/private.  The one that was recreated in files/ contains only a template_c directory and configandlog directory.  I looked at the civicrm.settings and found some paths for template_c and changed those to private/ but nothing regarding config and log... any ideas?  
  
  ---
  
  ### Answer by username_1 on 2017-08-04. Score: 2
  
  Pantheon allows you to protect (a limited number of) webpaths, using a pantheon.yml file.
  protected_web_paths:
    - /example_directory
  
  (https://pantheon.io/docs/pantheon-yml/#protected-web-paths)
  It is, in effect, a nginx deny.
  
  
  ---
  
  ### Answer by username_0 on 2015-08-07. Score: 2
  
  Thanks @username_2!
  I went with your recommendation and pushed the edited civi settings file up to pantheon but still got the same warnings. I then went into administer>system settings>directory and noticed that the settings where still pointing to the public files. I then sftp'd into sites/default/private and manually created the same directory names that civi was using in the public files. Then in the GUI I added private/ after files/ for all the upload directories.
  [![enter image description here](https://i.sstatic.net/8dB6V.png)](https://i.sstatic.net/8dB6V.png)
  
  Since the code didn't do the trick I reverted to prior settings and everything still works. I'm not getting the security warnings anymore.
  
  UPDATE:
  After @username_2 comment below, we went ahead and added his code mentioned in his answer in civicrm.settings.php. We had to replace the last line with :
  $civicrm\_setting['URL Preferences']['userFrameworkResourceURL'] = $base\_url . '/sites/all/extensions';
  
  Everything looks good now
  
  > **Comments:**
  > **username_2**: You should review [What is required to run CiviCRM on Pantheon?](http://civicrm.stackexchange.com/questions/4464/what-is-required-to-run-civicrm-on-pantheon) which better explains the reason for setting those paths in `civicrm.settings.php` - basically, at some point Pantheon is likely to move your `/srv/bindings/2c6caa...`path, and those settings now stored in your DB will stop working. That's why we load the binding root from `$pantheon_conf['pantheon_binding']` instead.  
  > **username_2**: To have the settings change from my answer work, make sure you're matching the context etc so that `$pantheon_conf` actually exists and contains your binding root. See linked issue for full details.  
  > **username_0**: Thank @Chris. We pasted your code and everything good. All I did was change the last line to this : $civicrm_setting['URL Preferences']['userFrameworkResourceURL'] = $base_url . '/sites/all/extensions';  
  
  ---
  
  