Harden data and config protection .htaccess #16792
Conversation
+ Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 Signed-off-by: Micha Felle <micha@dietpi.com>
+ Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com>
MichaIng
changed the title
+ Remove unnecessary spaces from code Co-Authored-By: Daniel Kesselberg <mail@danielkesselberg.de>
+ Ref: https://github.com/nextcloud/server/pull/16792/files#r315207691 Signed-off-by: Micha Felle <micha@dietpi.com>
+ Use Apache syntax with cases according to official docs: https://github.com/nextcloud/server/pull/16792/files#r315207691 + Add missing whitespace for concatenating strings to variable: https://github.com/nextcloud/server/pull/16792/files#r315207520 + Apache 2.5 will be released as 2.6: https://github.com/nextcloud/server/pull/16792/files#r315206147 Signed-off-by: Micha Felle <micha@dietpi.com>
+ Ref: https://github.com/nextcloud/server/pull/16792/files#r315206147 Signed-off-by: Micha Felle <micha@dietpi.com>
|
Actually, to be failsafe, it would make sense to add |
Signed-off-by: MichaIng <micha@dietpi.com>
Signed-off-by: MichaIng <micha@dietpi.com>
|
@nextcloud/security I added the |
|
Well 17 is already packaged. But I guess we can do it for 17.0.1 |
Signed-off-by: MichaIng <micha@dietpi.com>
|
Resolved conflict caused by format fix, which was also included in this PR: cdf8c16 |
|
Thanks for your first pull request and welcome to the community! Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22 |
Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow public access, regardless of "Require" directive.Deny from all" as well whenever available, to block access regardless of which access control directive takes priority.Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2..htaccessfiles.Remove one doubled whitespace+ some minor syntax "fixes" to match standards:ifModule=>IfModule$content.= "string";=>$content .= "string";Fixes: #6449
Signed-off-by: MichaIng micha@dietpi.com