diff options
| author | MichaIng <28480705+MichaIng@users.noreply.github.com> | 2019-08-19 15:17:39 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-08-19 15:17:39 +0200 |
| commit | e84cdc609a87d46db737e1dbdc5680321ce6939d (patch) | |
| tree | 4638ccb227f79d691ef1d05b660cd996a514da19 /lib/private/Setup.php | |
| parent | dcbf8fa8e31007d95a9651ab478d81074412fb7c (diff) | |
| download | nextcloud-server-e84cdc609a87d46db737e1dbdc5680321ce6939d.tar.gz nextcloud-server-e84cdc609a87d46db737e1dbdc5680321ce6939d.zip | |
Harden config protection .htaccess
+ Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive.
+ Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority.
+ Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2.
+ Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same.
+ Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files.
Fixes: #6449 (for the config directory)
Signed-off-by: Micha Felle <micha@dietpi.com>
Diffstat (limited to 'lib/private/Setup.php')
0 files changed, 0 insertions, 0 deletions