Security fix: Block access to /data dictionary!

jchaney · Mar 19, 2016 · 7d270fe · 7d270fe
1 parent 6454579
commit 7d270fe
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/configs/nginx.conf b/configs/nginx.conf
@@ -72,7 +72,7 @@ http {
             access_log off;
         }
 
-        location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README) {
+        location ~* ^/(?:staging/|~[^/]+/)?(?:owncloud/)?(?:data|config|\.ht|db_structure\.xml|README) {
             deny all;
         }
 

diff --git a/configs/nginx_ssl.conf b/configs/nginx_ssl.conf
@@ -98,7 +98,7 @@ http {
             access_log off;
         }
 
-        location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README) {
+        location ~* ^/(?:staging/|~[^/]+/)?(?:owncloud/)?(?:data|config|\.ht|db_structure\.xml|README) {
             deny all;
         }