Ttdfjt

My Magento 2 development environment has started poking me with the following error message

Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider

Has anyone tracked down

1. What security checks are happening?


2. Where in the core code these checks happen?

This check says that anyone can access to app/etc/* files. For example the app/etc/env.php file that stores credentials to DB, crypt key, and other resources.

The better solution is to configure your pub folder as the web root instead of the default installation directory, usually magento2, as specified in most install docs. This will improve overall security and fix you problem. Be sure to edit your other Apache/Nginx location definitions as well. For Nginx, the $MAGE_ROOT directive should be /var/www/example.com/magento2/pub, and so should your root directive. Be sure to flush your cache after making the change as well, otherwise images and css files will be broken (System -> Tools -> Cache Management -> Flush Magento Cache).

MagentoAdminNotificationModelSystemMessageSecurity is responsible for this functionality. See the _isFileAccessible method.

It will surely risk Magento store.

If you are using Apache, make sure that the .htaccess file that is included with magento in the /app/ folder is present on your web server, and that Apache is configured to use .htaccess files to override settings per folder, but this should be enabled by default.

The content of this file is supposed to be:

<IfVersion < 2.4>
 order allow,deny
 deny from all
</IfVersion>
<IfVersion >= 2.4>
 Require all denied
</IfVersion>

It's a system message and this message came from getText() method, class MagentoAdminNotificationModelSystemMessageSecurity.

When we open the Admin panel the controller checks the all notifications and it's related security.

you can debug from execute() method in MagentoAdminNotificationControllerAdminhtmlSystemMessageListAction.php.

MAGENTO 2 Centos 7 Server

To fix message "Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider".

1) ### shh- Run the following command from your root account. ###

chown -R accountuser:accountusergroup /path-to-root-folderl/

2) ### ssh - Run the following command from the domain account user(not your web server account such as apache etc). ###

find . -type d -exec chmod 770 ; & find . -type f -exec chmod 660 ; && chmod u+x bin/magento

chmod -R g+w /path-to-root-folderl/pub,var chmod -R g+w /path-to-root-folderl/app/etc,vendor chmod -R g+s pub/static pub/media . find var/generation -type d -exec chmod g+s ; find var/session -type d -exec chmod g+s ;

3) ### ssh - Run the following command from your root account. ###

chown -R domain_account_user:webservergroup /path-to-root-folderl/var chown -R domain_account_user:webservergroup /path-to-root-folder/app/etc chown -R domain_account_user:webservergroup /path-to-root-folderl/pub chown -R webserverUSER:webservergroup /path-to-root-folder/var/session

This will fix this error and many other error. Note: disable SUPHP when using magento 2, you will save yourself a lot of headache. Currently I'm running mod_mpm_event with ea-apache24-mod_cgid and PHP 7 and ea-php70-php-fpm.

I had my magento 2 running with just mod_mpm_event with ea-apache24-mod_cgid and PHP 7 before I added PHP-FPM.

If you are running cpanel/ apache and you don't want to use easyapache to move to mod_mpm_event + ea-apache24-mod_cgid you can use shell from ssh . Run the command bellow from ssh . yum shell remove ea-apache24-mod_mpm_worker remove ea-apache24-mod_cgi install ea-apache24-mod_mpm_event install ea-apache24-mod_cgid run quit

In my case the problem was caused by the fact that the default store view was disabled. While the security check was made, the MagentoAdminNotificationModelSystemMessageSecurity class tried to download the app/etc/config.php file, an exception was thrown (Fatal error: Uncaught MagentoFrameworkExceptionNoSuchEntityException: Default store is inactive), which transformed the response code to 200 (normally it should result 404). So the system thought that the file is accessible, which would mean a security issue.

Just enable the default store view to fix this.

It's a directory and files permission problem I think.
Please give proper permissions like
0755 to directories
0644 to files, if it doesn't solve the issue please check the .htaccess file also.

These tests are present inside the class MagentoAdminNotificationModelSystemMessageSecurity and that notifictaion text comes from function getText() . I think magento checks the accessibilty of app/etc/* files and based on that shows the warning in admin panel.