Answers.Body: <p>Your <code>.htaccess</code> file is incorrect.</p>
  
  <p>It should contain the following content:</p>
  
  
  
  <pre><code>
  # Turn off all options we don't need.
  Options -Indexes -ExecCGI -Includes -MultiViews
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  &lt;Files *&gt;
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  &lt;/Files&gt;
  # If we know how to do it safely, disable the PHP engine entirely.
  &lt;IfModule mod_php5.c&gt;
    php_flag engine off
  &lt;/IfModule&gt;
  
  </code></pre>
  
  <p>The remaining lines are added ONLY for private file storage, namely these lines:</p>
  
  
  
  <pre><code># Deny all requests from Apache 2.4+.
  &lt;IfModule mod_authz_core.c&gt;
    Require all denied
  &lt;/IfModule&gt;
  # Deny all requests from Apache 2.0-2.2.
  &lt;IfModule !mod_authz_core.c&gt;
    Deny from all
  &lt;/IfModule&gt;
  </code></pre>
  
  <p><strong>You should check your Drupal configuration, to ensure that you have a separate folder configured for private file storage, this should be outside your web root.</strong></p>
  
  <p>You should check your configuration against the Drupal documentation here: <a href="https://www.drupal.org/docs/7/install/setting-up-the-files-directory" rel="nofollow noreferrer">https://www.drupal.org/docs/7/install/setting-up-the-files-directory</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:45:36.993Z
Answers.Text: I will try that. Thank you. I am trying to understand why I need to have a separate folder configured for private file storage outside my web root. I don't see in https://www.drupal.org/docs/7/install/setting-up-the-files-directory anything in relation to that.
Answers.UserDisplayName: Pierre François
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:46:59.947Z
Answers.Text: The entire point of your private files folder is that it's private (i.e. not in your public files path). It is used for files that are delivered via PHP/Drupal and not via the web server.
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:47:23.810Z
Answers.Text: See this issue: https://www.drupal.org/project/documentation/issues/1006692
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:50:10.253Z
Answers.Text: This blog is useful as well: https://openconcept.ca/blog/mgifford/setting-drupal-7s-private-file-system
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:53:47.133Z
Answers.Text: OK. I understood that I don't need private files for now. The `.htaccess` that works for me is containing only the first part of the two ones that you posted in your answer.
Answers.UserDisplayName: Pierre François
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T13:59:58.197Z
Answers.Text: Make sure you turn off (clear!) the private files path in Drupal settings - otherwise Drupal will helpfully recreate the .htaccess it thinks should be there!
Answers.UserDisplayName: HomoTechsual
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T19:03:27.130Z
Answers.Text: It was not true I didn't need private files. I did for the module Backup and Migrate, but thanks to the hints I found here, I could manage it to make the module save the backups in a directory outside of the Drupal tree. This is an advantage because the backups now go directly to a directory that is synchronised with the cloud.
Answers.UserDisplayName: Pierre François
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-09T12:57:07.933Z
Answers.LastActivityDate: 2020-06-09T12:57:07.933Z
Answers.UserDisplayName: HomoTechsual
Body: <p>My CiviCRM menu bar doesn't appear at the right place on the page and its stylesheet is not loading. </p>
  
  <p>I have the same symptoms as in question <a href="https://civicrm.stackexchange.com/questions/30547/menu-problem-with-civicrm-5-13-2">Menu Problem with CiviCRM 5.13.2</a> but the solutions they offer there do not solve my issue.</p>
  
  <p>Since the picture of the heading at <code>http://***.be/sites/default/files/ocsr.png</code> doesn't show up, I discovered that the files under the directory <code>&lt;drupal_root&gt;/sites/default/files</code> are not served anymore by <code>apache</code> when requested by the browser.</p>
  
  <p>There is a <code>.htaccess</code> file in that directory containing:</p>
  
  <pre><code># Deny all requests from Apache 2.4+.
  &lt;IfModule mod_authz_core.c&gt;
    Require all denied
  &lt;/IfModule&gt;
  
  # Deny all requests from Apache 2.0-2.2.
  &lt;IfModule !mod_authz_core.c&gt;
    Deny from all
  &lt;/IfModule&gt;
  
  # Turn off all options we don't need.
  Options None
  Options +FollowSymLinks
  
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  &lt;Files *&gt;
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  &lt;/Files&gt;
  
  # If we know how to do it safely, disable the PHP engine entirely.
  &lt;IfModule mod_php5.c&gt;
    php_flag engine off
  &lt;/IfModule&gt;
  &lt;IfModule mod_php7.c&gt;
    php_flag engine off
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>My knowledge of <code>apache</code> is too poor to understand if this file is the guilty, but in the logs of <code>apache</code>, I see entries as:</p>
  
  <pre><code>[Tue Jun 09 14:18:54.299253 2020] [authz_core:error] [pid 30658] [client 127.0.0.1:42982] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/civicrm/persist/contribute/dyn/crm-menubar.4153687684a8323812edc1dc3cdbefbd.css
  [Tue Jun 09 14:38:46.732818 2020] [authz_core:error] [pid 22455] [client 127.0.0.1:43090] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/ocsr.png
  </code></pre>
  
  <p>that seem to be connected directly with my issue. </p>
  
  <p>Since I am a newbie with CiviCRM, I don't have any clue about how to solve this. </p>
  
  <p>Perhaps another useful information: I didn't have time to upgrade to the last version of Drupal 7 up to now. I don't know if the problem is coming from that delay and I don't know what is better: first solve the issue and then upgrade, or the contrary.</p>
  
Tags: <drupal>
Title: Menu Problem with CiviCRM 5.26.0 in Drupal
ThreadText: # Menu Problem with CiviCRM 5.26.0 in Drupal
  
  (Asked by: username_0 on 2020-06-09)
  
  My CiviCRM menu bar doesn't appear at the right place on the page and its stylesheet is not loading. 
  I have the same symptoms as in question Menu Problem with CiviCRM 5.13.2 but the solutions they offer there do not solve my issue.
  Since the picture of the heading at http://***.be/sites/default/files/ocsr.png doesn't show up, I discovered that the files under the directory /sites/default/files are not served anymore by apache when requested by the browser.
  There is a .htaccess file in that directory containing:
  # Deny all requests from Apache 2.4+.
  
    Require all denied
  
  
  # Deny all requests from Apache 2.0-2.2.
  
    Deny from all
  
  
  # Turn off all options we don't need.
  Options None
  Options +FollowSymLinks
  
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  
  
  # If we know how to do it safely, disable the PHP engine entirely.
  
    php_flag engine off
  
  
    php_flag engine off
  
  
  My knowledge of apache is too poor to understand if this file is the guilty, but in the logs of apache, I see entries as:
  [Tue Jun 09 14:18:54.299253 2020] [authz_core:error] [pid 30658] [client 127.0.0.1:42982] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/civicrm/persist/contribute/dyn/crm-menubar.4153687684a8323812edc1dc3cdbefbd.css
  [Tue Jun 09 14:38:46.732818 2020] [authz_core:error] [pid 22455] [client 127.0.0.1:43090] AH01630: client denied by server configuration: /usr/share/drupal/sites/default/files/ocsr.png
  
  that seem to be connected directly with my issue. 
  Since I am a newbie with CiviCRM, I don't have any clue about how to solve this. 
  Perhaps another useful information: I didn't have time to upgrade to the last version of Drupal 7 up to now. I don't know if the problem is coming from that delay and I don't know what is better: first solve the issue and then upgrade, or the contrary.
  
  **Tags:** drupal
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-06-09. Score: 1 | Accepted answer
  
  Your .htaccess file is incorrect.
  It should contain the following content:
  
  # Turn off all options we don't need.
  Options -Indexes -ExecCGI -Includes -MultiViews
  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  
  # If we know how to do it safely, disable the PHP engine entirely.
  
    php_flag engine off
  
  
  
  The remaining lines are added ONLY for private file storage, namely these lines:
  # Deny all requests from Apache 2.4+.
  
    Require all denied
  
  # Deny all requests from Apache 2.0-2.2.
  
    Deny from all
  
  
  You should check your Drupal configuration, to ensure that you have a separate folder configured for private file storage, this should be outside your web root.
  You should check your configuration against the Drupal documentation here: https://www.drupal.org/docs/7/install/setting-up-the-files-directory
  
  > **Comments:**
  > **username_0**: I will try that. Thank you. I am trying to understand why I need to have a separate folder configured for private file storage outside my web root. I don't see in https://www.drupal.org/docs/7/install/setting-up-the-files-directory anything in relation to that.  
  > **username_1**: The entire point of your private files folder is that it's private (i.e. not in your public files path). It is used for files that are delivered via PHP/Drupal and not via the web server.  
  > **username_1**: See this issue: https://www.drupal.org/project/documentation/issues/1006692  
  > **username_1**: This blog is useful as well: https://openconcept.ca/blog/mgifford/setting-drupal-7s-private-file-system  
  > **username_0**: OK. I understood that I don't need private files for now. The `.htaccess` that works for me is containing only the first part of the two ones that you posted in your answer.  
  > **username_1**: Make sure you turn off (clear!) the private files path in Drupal settings - otherwise Drupal will helpfully recreate the .htaccess it thinks should be there!  
  > **username_0**: It was not true I didn't need private files. I did for the module Backup and Migrate, but thanks to the hints I found here, I could manage it to make the module save the backups in a directory outside of the Drupal tree. This is an advantage because the backups now go directly to a directory that is synchronised with the cloud.  
  
  ---
  
  