Skip to content

Harden data and config protection .htaccess #16792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rullzer merged 10 commits into from
Dec 19, 2019
Merged

Harden data and config protection .htaccess #16792

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
dcbf8fa
Harden data protection .htaccess
MichaIng Aug 19, 2019
e84cdc6
Harden config protection .htaccess
MichaIng Aug 19, 2019
01b558c
Update lib/private/Setup.php
MichaIng Aug 19, 2019
a849b32
Use syntax with cases according to official docs
MichaIng Aug 19, 2019
51a35bb
Minor syntax
MichaIng Aug 19, 2019
2411455
Apache 2.5 will be released as 2.6
MichaIng Aug 19, 2019
592eecd
Add "Order" to assure that no parental "Allow" can grant access
MichaIng Sep 26, 2019
c7e66ec
Add "Order" to assure that no parental "Allow" can grant access
MichaIng Sep 26, 2019
5afd7ab
Add missing newlines to .htaccess
MichaIng Oct 31, 2019
4384806
Merge branch 'master' into patch-1
MichaIng Dec 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 23 additions & 12 deletions config/.htaccess
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,25 @@
# line below if for Apache 2.4
<ifModule mod_authz_core.c>
Require all denied
</ifModule>
# Section for Apache 2.4 to 2.6
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule mod_access_compat.c>
Order Allow,Deny
Deny from all
Satisfy All
</IfModule>

# line below if for Apache 2.2
<ifModule !mod_authz_core.c>
deny from all
</ifModule>
# Section for Apache 2.2
<IfModule !mod_authz_core.c>
<IfModule !mod_access_compat.c>
<IfModule mod_authz_host.c>
Order Allow,Deny
Deny from all
</IfModule>
Satisfy All
</IfModule>
</IfModule>

# section for Apache 2.2 and 2.4
<ifModule mod_autoindex.c>
IndexIgnore *
</ifModule>
# Section for Apache 2.2 to 2.6
<IfModule mod_autoindex.c>
IndexIgnore *
</IfModule>
36 changes: 23 additions & 13 deletions lib/private/Setup.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,19 +553,29 @@ public static function protectDataDirectory() {
//Require all denied
$now = date('Y-m-d H:i:s');
$content = "# Generated by Nextcloud on $now\n";
$content .= "# line below if for Apache 2.4\n";
$content .= "<ifModule mod_authz_core.c>\n";
$content .= "Require all denied\n";
$content .= "</ifModule>\n\n";
$content .= "# line below if for Apache 2.2\n";
$content .= "<ifModule !mod_authz_core.c>\n";
$content .= "deny from all\n";
$content .= "Satisfy All\n";
$content .= "</ifModule>\n\n";
$content .= "# section for Apache 2.2 and 2.4\n";
$content .= "<ifModule mod_autoindex.c>\n";
$content .= "IndexIgnore *\n";
$content .= "</ifModule>\n";
$content .= "# Section for Apache 2.4 to 2.6\n";
$content .= "<IfModule mod_authz_core.c>\n";
$content .= " Require all denied\n";
$content .= "</IfModule>\n";
$content .= "<IfModule mod_access_compat.c>\n";
$content .= " Order Allow,Deny\n";
$content .= " Deny from all\n";
$content .= " Satisfy All\n";
$content .= "</IfModule>\n\n";
$content .= "# Section for Apache 2.2\n";
$content .= "<IfModule !mod_authz_core.c>\n";
$content .= " <IfModule !mod_access_compat.c>\n";
$content .= " <IfModule mod_authz_host.c>\n";
$content .= " Order Allow,Deny\n";
$content .= " Deny from all\n";
$content .= " <IifModule>\n";
$content .= " Satisfy All\n";
$content .= " </IfModule>\n";
$content .= "</IfModule>\n\n";
$content .= "# Section for Apache 2.2 to 2.6\n";
$content .= "<IfModule mod_autoindex.c>\n";
$content .= " IndexIgnore *\n";
$content .= "</IfModule>";

$baseDir = \OC::$server->getConfig()->getSystemValue('datadirectory', \OC::$SERVERROOT . '/data');
file_put_contents($baseDir . '/.htaccess', $content);
Expand Down