Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add .htpasswd to banned locations in nginx config #34388

Merged
merged 1 commit into from May 18, 2022
Merged

Add .htpasswd to banned locations in nginx config #34388

merged 1 commit into from May 18, 2022

Conversation

marvinhinz
Copy link
Contributor

@marvinhinz marvinhinz commented Oct 19, 2021 •
edited by m2-assistant bot

Description (*)

The nginx config file contains a section that catches and blocks requests that dont match the other blocks. If the .htaccess is blocked, it just seems logical to exclude the .htpasswd too because of sensitive data.

Sometimes nginx is used in front of apache as a reverse proxy, so it is possible for apache config files to exist.

Related Pull Requests

Fixed Issues (if relevant)

  1. Fixes magento/magento2#<issue_number>

Manual testing scenarios (*)

  1. ...
  2. ...

Questions or comments

Contribution checklist (*)

  • Pull request has a meaningful description of its purpose
  • All commits are accompanied by meaningful commit messages
  • All new or changed code is covered with unit/integration tests (if applicable)
  • README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
  • All automated tests passed successfully (all builds are green)

Resolved issues:

  1. resolves [Issue] Add .htpasswd to banned locations in nginx config #35150: Add .htpasswd to banned locations in nginx config

@m2-assistant
Copy link

m2-assistant bot commented Oct 19, 2021

Hi @marvinhinz. Thank you for your contribution
Here are some useful tips how you can test your changes using Magento test environment.
Add the comment under your pull request to deploy test or vanilla Magento instance:

  • @magento give me test instance - deploy test instance based on PR changes
  • @magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

  • @magento run all tests - run or re-run all required tests against the PR changes
  • @magento run <test-build(s)> - run or re-run specific test build(s)
    For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names. Allowed build names are:

  1. Database Compare
  2. Functional Tests CE
  3. Functional Tests EE,
  4. Functional Tests B2B
  5. Integration Tests
  6. Magento Health Index
  7. Sample Data Tests CE
  8. Sample Data Tests EE
  9. Sample Data Tests B2B
  10. Static Tests
  11. Unit Tests
  12. WebAPI Tests
  13. Semantic Version Checker

You can find more information about the builds here

ℹ️ Please run only needed test builds instead of all when developing. Please run all test builds before sending your PR for review.

For more details, please, review the Magento Contributor Guide documentation.

⚠️ According to the Magento Contribution requirements, all Pull Requests must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.

🕙 You can find the schedule on the Magento Community Calendar page.

📞 The triage of Pull Requests happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket.

🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel

✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

@m2-community-project m2-community-project bot added this to Ready for Testing in Pull Requests Dashboard Oct 21, 2021
@ihor-sviziev ihor-sviziev added Auto-Tests: Not Required Changes in Pull Request does not require coverage by auto-tests Risk: low Severity: S3 Affects non-critical data or functionality and does not force users to employ a workaround. labels Oct 21, 2021
@magento-engcom-team
Copy link
Contributor

Hi @ihor-sviziev, thank you for the review.
ENGCOM-9272 has been created to process this Pull Request

@sidolov sidolov added the Priority: P2 A defect with this priority could have functionality issues which are not to expectations. label Oct 28, 2021
@m2-community-project m2-community-project bot removed this from Ready for Testing in Pull Requests Dashboard Oct 28, 2021
@engcom-Alfa
Copy link
Contributor

@magento run all tests

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@engcom-Alfa
Copy link
Contributor

Hi @marvinhinz and @ihor-sviziev
Thanks for your contribution and collaboration!
As part of QA validation, could you please help me with steps to reproduce the existing issue where exactly and how that reflects, so that we can validate the changes for further steps.
Thanks in advance!

@engcom-Alfa engcom-Alfa self-assigned this Nov 10, 2021
@engcom-Alfa engcom-Alfa moved this from Ready for Testing to Testing in Progress in High Priority Pull Requests Dashboard Nov 10, 2021
@engcom-Alfa
Copy link
Contributor

@magento run Functional Tests B2B, Functional Tests CE, Functional Tests EE

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@engcom-Alfa
Copy link
Contributor

@magento run Functional Tests B2B, Functional Tests CE, Functional Tests EE

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@ihor-sviziev
Copy link
Contributor

@magento run Functional Tests CE

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

2 similar comments
@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@engcom-Alfa
Copy link
Contributor

@magento run Functional Tests CE

@m2-community-project m2-community-project bot moved this from Review in Progress to Ready for Testing in High Priority Pull Requests Dashboard Dec 28, 2021
@magento-engcom-team
Copy link
Contributor

Hi @ihor-sviziev, thank you for the review.
ENGCOM-9379 has been created to process this Pull Request

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

1 similar comment
@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@engcom-Dash engcom-Dash self-assigned this Jan 13, 2022
@engcom-Dash engcom-Dash moved this from Ready for Testing to Testing in Progress in High Priority Pull Requests Dashboard Jan 13, 2022
@ihor-sviziev
Copy link
Contributor

ihor-sviziev commented Jan 17, 2022 via email

@engcom-Alfa
Copy link
Contributor

engcom-Alfa commented Jan 18, 2022 •
edited

Hi @ihor-sviziev , @marvinhinz , @hostep and @andrewbess

We have just followed the below given steps:

  1. Utilised my local installed magento instance version 2.4-develop (Not included this PR changes)
  2. Created a file .htpaswrd and .htaccess in magento root folder/pub.
  3. Instance upgraded and flushed properly
  4. Accessed the file from the web browser

As per the above comments and descriptions, I have to expect the issue where we should be able to access the created files. But there is no issue as such prior pulling the PR changes, because the files are not accessible as shown the below screenshot.
image

Kindly recommend us if we have to change in our execution procedure.

cc: @engcom-Dash

@engcom-Alfa
Copy link
Contributor

✔️ QA Passed

Preconditions:

  1. Have Magento installed in the ngnix server
  2. make sure Magento is working properly.

Manual testing scenario:

  1. Default we will find .htaccess file inside the magento_root/pub folder; Duplicate the file and rename that duplicated new file with .htpasswd file name.

  2. Restart the nginx and upgrade the magento once

  3. Try to access the file using the link http://application_domain/pub/.htpasswd from browser.

Before: ✖️ .htpasswd file was responding with some data in the browser
image

After: ✔️ Completely not responding with the data and giving an error now

Since this PR is related to accessing the non-functional file and has no impact on any features, there is no additional testing is required

@engcom-Alfa engcom-Alfa moved this from Testing in Progress to Merge in Progress in High Priority Pull Requests Dashboard Jan 28, 2022
@engcom-Alfa engcom-Alfa reopened this Jan 28, 2022
@m2-community-project m2-community-project bot removed this from Merge in Progress in High Priority Pull Requests Dashboard Jan 28, 2022
@engcom-Alfa
Copy link
Contributor

@magento create issue

@m2-assistant m2-assistant bot mentioned this pull request Feb 28, 2022
Closed
5 tasks
@engcom-Alfa engcom-Alfa moved this from Ready for Testing to Merge in Progress in High Priority Pull Requests Dashboard Mar 1, 2022
@magento-devops-reposync-svc magento-devops-reposync-svc merged commit 6be28a6 into magento:2.4-develop May 18, 2022
@ishakhsuvarov ishakhsuvarov moved this from Merge in Progress to Recently Merged in High Priority Pull Requests Dashboard May 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hostep hostep hostep left review comments

@ihor-sviziev ihor-sviziev ihor-sviziev approved these changes

Assignees

@hostep hostep

@ihor-sviziev ihor-sviziev

@andrewbess andrewbess

@engcom-Alfa engcom-Alfa

@engcom-Dash engcom-Dash

Labels
Auto-Tests: Not Required Changes in Pull Request does not require coverage by auto-tests Priority: P2 A defect with this priority could have functionality issues which are not to expectations. Progress: accept Release Line: 2.4 Risk: low Severity: S3 Affects non-critical data or functionality and does not force users to employ a workaround.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Issue] Add .htpasswd to banned locations in nginx config
9 participants
@marvinhinz @magento-engcom-team @engcom-Alfa @ihor-sviziev @andrewbess @hostep @sidolov @engcom-Dash @magento-devops-reposync-svc