Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #2948579 by greggles, mcdruid, longwave, Chi, rabbitlair, alexpott, DKAN, beckydev, interX, sammuell: Block web.config in .htaccess (and vice-versa)

merge-requests/1119/head
Alex Pott 2019-04-16 17:10:51 +01:00
parent 340d33e7d0
commit dfa4cdebef
No known key found for this signature in database
GPG Key ID: 31905460D4A69276
5 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.htaccess
View File

@ -3,7 +3,7 @@
# #
# Protect files and directories from prying eyes. # Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$"> <FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
Require all denied Require all denied
</IfModule> </IfModule>

0
core/modules/system/tests/fixtures/HtaccessTest/.htaccess vendored Normal file
View File

0
core/modules/system/tests/fixtures/HtaccessTest/web.config vendored Normal file
View File

4
core/modules/system/tests/src/Functional/System/HtaccessTest.php
View File

@ -86,6 +86,10 @@ class HtaccessTest extends BrowserTestBase {
$file_paths["$path/composer.json"] = 403; $file_paths["$path/composer.json"] = 403;
$file_paths["$path/composer.lock"] = 403; $file_paths["$path/composer.lock"] = 403;
// Ensure web server configuration files cannot be accessed.
$file_paths["$path/.htaccess"] = 403;
$file_paths["$path/web.config"] = 403;
return $file_paths; return $file_paths;
} }

2
web.config
View File

@ -22,7 +22,7 @@
<rewrite> <rewrite>
<rules> <rules>
<rule name="Protect files and directories from prying eyes" stopProcessing="true"> <rule name="Protect files and directories from prying eyes" stopProcessing="true">
<match url="\.(engine|inc|install|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml|svn-base)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template|all-wcprops|entries|format|composer\.(json|lock))$" /> <match url="\.(engine|inc|install|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml|svn-base)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template|all-wcprops|entries|format|composer\.(json|lock)|\.htaccess)$" />
<action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Access is forbidden." /> <action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Access is forbidden." />
</rule> </rule>