/app /vendor etc. folders are accessible ! Security ?

[benjbdev]

Hello,
Is there an issue to securise /app and /vendor folders ? They are accessible by default !!!

Thanks !

[toin0u]

Hi,

I'm an NginX user and the configuration written here works well: http://docs.bolt.cm/setup

I guess you use Apache and you're right we need to improve the .htaccess file I think: https://github.com/bolt/bolt/blob/master/.htaccess
With the directive maybe ? http://httpd.apache.org/docs/2.0/mod/core.html#directory

[benjbdev]

Yes i'm an Apache user :)
I'm the only one to have this problem ?

[toin0u]

Did you tried to add something like this in the .htaccess file ?

<Directory /app>
    Order Deny,Allow
    Deny from All
</Directory> 
<Directory /vendor>
    Order Deny,Allow
    Deny from All
</Directory> 

[benjbdev]

Not working in .htaccess file.
I put it on the httpd.conf and now it's ok. With a 404 redirection instead of a 403 .. :)

<Directory "C:/wamp/www/bolt/app">
    Order Deny,Allow
    Deny from All
</Directory>
RedirectMatch 404 ^/app(/?|/.*)$
<Directory "C:/wamp/www/bolt/vendor">
    Order Deny,Allow
    Deny from All
</Directory> 
RedirectMatch 404 ^/vendor(/?|/.*)$

Thank for your help

[benjbdev]

Hmm it's not ok lol :)
Now all files like /app/view/js/bolt.js are not availables.. !

[richardhinkamp]

What is the problem with those folders being accessible? Config files and the database are not accessible, php files are not a problem. What files/folders might be a problem?

[benjbdev]

Are you sure about non-vulnerabilty in PHP files ?

[richardhinkamp]

I have not checked them all no...
So a rewrite line like:

  RewriteRule ^vendor/(.*)?$ / [R=301,L]

Might not be a bad idea?

[toin0u]

@richardhinkamp I think it's a good idea - let's do the same for app folder as well.

[benjbdev]

Hey guys it's not working cause the css, js files in the ADMIN are called from app/ folder !!!

[richardhinkamp]

Hmm except /app/view/, that contains css,js,etc

[toin0u]

You're right.

@bobdenotter What do you think ?

[richardhinkamp]

/app/classes/ also contains some files which should be accessible. This folder may need some cleanup since it contains different kind of files.

[bobdenotter]

I think we should merge in both your fixes. Richard's fix prevents all access to those folder, and @toin0u's prevents listing any other folders. I thought that directory listings were disabled by default, but it sure doesn't hurt to make sure. Thanks, both!