Mirrors/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2024-09-08 15:57:54 +02:00
Code Issues Actions 24 Packages Projects Releases Wiki Activity
362c6238fc
nextcloud/config/.htaccess

29 lines
665 B
ApacheConf
Raw Normal View History

chore: Add SPDX header Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
2024-06-06 19:48:28 +02:00
# SPDX-FileCopyrightText: 2017-2024 Nextcloud GmbH and Nextcloud contributors
# SPDX-FileCopyrightText: 2014-2015 ownCloud, Inc.
# SPDX-License-Identifier: AGPL-3.0-only
Apache 2.5 will be released as 2.6 + Ref: https://github.com/nextcloud/server/pull/16792/files#r315206147 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:51:55 +02:00
# Section for Apache 2.4 to 2.6
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
<IfModule mod_authz_core.c>
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:17:39 +02:00
Require all denied
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
</IfModule>
<IfModule mod_access_compat.c>
Add "Order" to assure that no parental "Allow" can grant access Signed-off-by: MichaIng <micha@dietpi.com>
2019-09-26 12:37:07 +02:00
Order Allow,Deny
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:17:39 +02:00
Deny from all
Satisfy All
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
</IfModule>
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-)
2014-04-24 08:33:58 +02:00
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:17:39 +02:00
# Section for Apache 2.2
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
<IfModule !mod_authz_core.c>
<IfModule !mod_access_compat.c>
<IfModule mod_authz_host.c>
Add "Order" to assure that no parental "Allow" can grant access Signed-off-by: MichaIng <micha@dietpi.com>
2019-09-26 12:37:07 +02:00
Order Allow,Deny
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:17:39 +02:00
Deny from all
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
</IfModule>
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:17:39 +02:00
Satisfy All
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
</IfModule>
</IfModule>
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-)
2014-04-24 08:33:58 +02:00
Apache 2.5 will be released as 2.6 + Ref: https://github.com/nextcloud/server/pull/16792/files#r315206147 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:51:55 +02:00
# Section for Apache 2.2 to 2.6
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
<IfModule mod_autoindex.c>
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:17:39 +02:00
IndexIgnore *
Use syntax with cases according to official docs + Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:40:00 +02:00
</IfModule>
Reference in New Issue Copy Permalink