CHAPTER 14 ■ WORKING WITH FILES

Public Files

The most straightforward configuration is the public file download method, in which Drupal stays out of the download process. When files are uploaded, Drupal simply saves them in the directory you’ve specified in Configuration -> File system and keeps track of the URLs of the files in a database table (so Drupal knows which files are available, who uploaded them, and so on). When a file is requested, it’s transferred directly by the web server over HTTP as a static file and Drupal isn’t involved at all. This has the advantage of being very fast, because no PHP needs to be executed. However, no Drupal user permissions are checked.

When specifying the file system path, the folder must exist and be writable by PHP. Usually the user (on the operating system) that is running the web server is also the same user running PHP. Thus, giving that user write permission to the files folder allows Drupal to upload files. With that done, be sure to specify the file system path at Configuration -> File system. Once these changes are saved, Drupal automatically creates an .htaccess file inside your files folder. This is necessary to protect your server from a known Apache security exploit allowing users to upload and execute scripts embedded in uploaded files (see http://drupal.org/node/66763). Check to make sure your files folder contains an

.htaccess file containing the following information:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

Options None

Options +FollowSymLinks

■ Tip When running Drupal on a web server cluster, the location of the temporary files directory needs to be shared by all web servers. Because Drupal may use one request to upload the file and a second to change its status from temporary to permanent, many load-balancing schemes will result in the temp file going to one server while the second request goes to another. When this happens, files will appear to upload properly, but will never appear in the nodes or content to which they’re attached. Ensure that all your web servers are using the same shared temp directory, and use a sessions-based load balancer. Your files directory, like your database, should be global to your web servers.

Private Files

In private download mode, the files folder can be located anywhere PHP may read and write, and need not be (and in most cases ought not be) directly accessible by the web server itself.

The security of private files comes at a performance cost. Rather than delegating the work of file serving to the web server, Drupal takes on the responsibility of checking access permissions and serving out the files, and Drupal is fully bootstrapped on every file request.

PHP Settings

A number of settings in php.ini are easy to overlook but are important for file uploads. The first is post_max_size under the Data Handling section of php.ini. Because files are uploaded by an HTTP POST

325