Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #2989262 by Daniel Korte, Kristen Pol: Escape all RewriteCond/RewriteRule .htaccess dots

merge-requests/2/head
Alex Pott 2020-07-17 08:47:57 +01:00
parent 38d02d6e4b
commit 952c086697
No known key found for this signature in database
GPG Key ID: 31905460D4A69276
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
.htaccess
View File

@ -116,13 +116,13 @@ AddEncoding gzip svgz
# RewriteBase / # RewriteBase /
# Redirect common PHP files to their new locations. # Redirect common PHP files to their new locations.
RewriteCond %{REQUEST_URI} ^(.*)?/(install.php) [OR] RewriteCond %{REQUEST_URI} ^(.*)?/(install\.php) [OR]
RewriteCond %{REQUEST_URI} ^(.*)?/(rebuild.php) RewriteCond %{REQUEST_URI} ^(.*)?/(rebuild\.php)
RewriteCond %{REQUEST_URI} !core RewriteCond %{REQUEST_URI} !core
RewriteRule ^ %1/core/%2 [L,QSA,R=301] RewriteRule ^ %1/core/%2 [L,QSA,R=301]
# Rewrite install.php during installation to see if mod_rewrite is working # Rewrite install.php during installation to see if mod_rewrite is working
RewriteRule ^core/install.php core/install.php?rewrite=ok [QSA,L] RewriteRule ^core/install\.php core/install.php?rewrite=ok [QSA,L]
# Pass all requests not referring directly to files in the filesystem to # Pass all requests not referring directly to files in the filesystem to
# index.php. # index.php.
@ -138,11 +138,11 @@ AddEncoding gzip svgz
# Allow access to PHP files in /core (like authorize.php or install.php): # Allow access to PHP files in /core (like authorize.php or install.php):
RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$ RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
# Allow access to test-specific PHP files: # Allow access to test-specific PHP files:
RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?.php RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?\.php
# Allow access to Statistics module's custom front controller. # Allow access to Statistics module's custom front controller.
# Copy and adapt this rule to directly execute PHP files in contributed or # Copy and adapt this rule to directly execute PHP files in contributed or
# custom modules or to run another PHP application in the same directory. # custom modules or to run another PHP application in the same directory.
RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$ RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics\.php$
# Deny access to any other PHP files that do not match the rules above. # Deny access to any other PHP files that do not match the rules above.
# Specifically, disallow autoload.php from being served directly. # Specifically, disallow autoload.php from being served directly.
RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F] RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F]

10
core/assets/scaffold/files/htaccess
View File

@ -116,13 +116,13 @@ AddEncoding gzip svgz
# RewriteBase / # RewriteBase /
# Redirect common PHP files to their new locations. # Redirect common PHP files to their new locations.
RewriteCond %{REQUEST_URI} ^(.*)?/(install.php) [OR] RewriteCond %{REQUEST_URI} ^(.*)?/(install\.php) [OR]
RewriteCond %{REQUEST_URI} ^(.*)?/(rebuild.php) RewriteCond %{REQUEST_URI} ^(.*)?/(rebuild\.php)
RewriteCond %{REQUEST_URI} !core RewriteCond %{REQUEST_URI} !core
RewriteRule ^ %1/core/%2 [L,QSA,R=301] RewriteRule ^ %1/core/%2 [L,QSA,R=301]
# Rewrite install.php during installation to see if mod_rewrite is working # Rewrite install.php during installation to see if mod_rewrite is working
RewriteRule ^core/install.php core/install.php?rewrite=ok [QSA,L] RewriteRule ^core/install\.php core/install.php?rewrite=ok [QSA,L]
# Pass all requests not referring directly to files in the filesystem to # Pass all requests not referring directly to files in the filesystem to
# index.php. # index.php.
@ -138,11 +138,11 @@ AddEncoding gzip svgz
# Allow access to PHP files in /core (like authorize.php or install.php): # Allow access to PHP files in /core (like authorize.php or install.php):
RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$ RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
# Allow access to test-specific PHP files: # Allow access to test-specific PHP files:
RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?.php RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?\.php
# Allow access to Statistics module's custom front controller. # Allow access to Statistics module's custom front controller.
# Copy and adapt this rule to directly execute PHP files in contributed or # Copy and adapt this rule to directly execute PHP files in contributed or
# custom modules or to run another PHP application in the same directory. # custom modules or to run another PHP application in the same directory.
RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$ RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics\.php$
# Deny access to any other PHP files that do not match the rules above. # Deny access to any other PHP files that do not match the rules above.
# Specifically, disallow autoload.php from being served directly. # Specifically, disallow autoload.php from being served directly.
RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F] RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F]