Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harden data and config protection .htaccess #16792

Merged
merged 10 commits into from
Dec 19, 2019
Merged

Harden data and config protection .htaccess #16792

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
dcbf8fa
Harden data protection .htaccess
MichaIng Aug 19, 2019
e84cdc6
Harden config protection .htaccess
MichaIng Aug 19, 2019
01b558c
Update lib/private/Setup.php
MichaIng Aug 19, 2019
a849b32
Use syntax with cases according to official docs
MichaIng Aug 19, 2019
51a35bb
Minor syntax
MichaIng Aug 19, 2019
2411455
Apache 2.5 will be released as 2.6
MichaIng Aug 19, 2019
592eecd
Add "Order" to assure that no parental "Allow" can grant access
MichaIng Sep 26, 2019
c7e66ec
Add "Order" to assure that no parental "Allow" can grant access
MichaIng Sep 26, 2019
5afd7ab
Add missing newlines to .htaccess
MichaIng Oct 31, 2019
4384806
Merge branch 'master' into patch-1
MichaIng Dec 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions config/.htaccess
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,23 @@
# line below if for Apache 2.4
# Section for Apache 2.4 and 2.5
<ifModule mod_authz_core.c>
Require all denied
Require all denied
</ifModule>
<ifModule mod_access_compat.c>
Deny from all
Satisfy All
</ifModule>

# line below if for Apache 2.2
# Section for Apache 2.2
<ifModule !mod_authz_core.c>
deny from all
<ifModule !mod_access_compat.c>
<ifModule mod_authz_host.c>
Deny from all
</ifModule>
Satisfy All
</ifModule>
</ifModule>

# section for Apache 2.2 and 2.4
# Section for Apache 2.2 to 2.5
<ifModule mod_autoindex.c>
IndexIgnore *
IndexIgnore *
</ifModule>
24 changes: 16 additions & 8 deletions lib/private/Setup.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -542,19 +542,27 @@ public static function protectDataDirectory() {
//Require all denied
$now = date('Y-m-d H:i:s');
MichaIng marked this conversation as resolved.
Show resolved Hide resolved
$content = "# Generated by Nextcloud on $now\n";
$content.= "# line below if for Apache 2.4\n";
$content.= "# Section for Apache 2.4 and 2.5\n";
MichaIng marked this conversation as resolved.
Show resolved Hide resolved
$content.= "<ifModule mod_authz_core.c>\n";
$content.= "Require all denied\n";
$content.= " Require all denied\n";
$content.= "</ifModule>\n";
MichaIng marked this conversation as resolved.
Show resolved Hide resolved
$content.= "<ifModule mod_access_compat.c>\n";
$content.= " Deny from all\n";
$content.= " Satisfy All\n";
$content.= "</ifModule>\n\n";
$content.= "# line below if for Apache 2.2\n";
$content.= "# Section for Apache 2.2\n";
$content.= "<ifModule !mod_authz_core.c>\n";
MichaIng marked this conversation as resolved.
Show resolved Hide resolved
$content.= "deny from all\n";
$content.= "Satisfy All\n";
$content.= " <ifModule !mod_access_compat.c>\n";
$content.= " <ifModule mod_authz_host.c>\n";
$content.= " Deny from all\n";
$content.= " </ifModule>\n";
$content.= " Satisfy All\n";
$content.= " </ifModule>\n";
$content.= "</ifModule>\n\n";
$content.= "# section for Apache 2.2 and 2.4\n";
$content.= "# Section for Apache 2.2 to 2.5\n";
$content.= "<ifModule mod_autoindex.c>\n";
$content.= "IndexIgnore *\n";
$content.= "</ifModule>\n";
$content.= " IndexIgnore *\n";
$content.= "</ifModule>";

$baseDir = \OC::$server->getConfig()->getSystemValue('datadirectory', \OC::$SERVERROOT . '/data');
file_put_contents($baseDir . '/.htaccess', $content);
Expand Down