From 8c3bf139ffe9f35e4d631827fe659b13cebca388 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20J=C3=A4ckel?= Date: Thu, 27 Nov 2014 17:14:27 +0100 Subject: [PATCH 1/2] restrict access to public files only use mod_rewrite to pretend theese files are not existend for security purposes --- .htaccess | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.htaccess b/.htaccess index e45810d0a05..3d06753e9eb 100644 --- a/.htaccess +++ b/.htaccess @@ -25,6 +25,8 @@ RewriteRule ^\.well-known/caldav /remote.php/caldav/ [R] RewriteRule ^apps/calendar/caldav\.php remote.php/caldav/ [QSA,L] RewriteRule ^apps/contacts/carddav\.php remote.php/carddav/ [QSA,L] RewriteRule ^remote/(.*) remote.php [QSA,L] +RewriteRule ^(build|tests|config|lib|l10n|templates)/.* - [R=404,L] +RewriteRule ^(\.|autotest|occ|issue|indie|db_|console).* - [R=404,L] AddType image/svg+xml svg svgz From 1a6928f44787cccbaddb59e4d72e0ef131a40a39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20J=C3=A4ckel?= Date: Thu, 27 Nov 2014 17:33:45 +0100 Subject: [PATCH 2/2] blocked 3rdparty instead of l10n --- .htaccess | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.htaccess b/.htaccess index 3d06753e9eb..10adb902ff5 100644 --- a/.htaccess +++ b/.htaccess @@ -25,7 +25,7 @@ RewriteRule ^\.well-known/caldav /remote.php/caldav/ [R] RewriteRule ^apps/calendar/caldav\.php remote.php/caldav/ [QSA,L] RewriteRule ^apps/contacts/carddav\.php remote.php/carddav/ [QSA,L] RewriteRule ^remote/(.*) remote.php [QSA,L] -RewriteRule ^(build|tests|config|lib|l10n|templates)/.* - [R=404,L] +RewriteRule ^(build|tests|config|lib|3rdparty|templates)/.* - [R=404,L] RewriteRule ^(\.|autotest|occ|issue|indie|db_|console).* - [R=404,L]