New webserver makes old lighttpd contents visible

[Hk1020]

Versions

• Pi-hole: v6.0.4
• AdminLTE: v6.0.1
• FTL: v6.0.3

Platform

• OS and version:

• Platform:

Linux raspberrypi 6.1.21-v8+ pi-hole/pi-hole#1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023 aarch64 GNU/Linux

Expected behavior

Files/contents from (old) lighttpd should not be served

Actual behavior / bug

Files from lighttpd are also visible via pihole’s new webserver

Steps to reproduce

I’ve updated to v6 keeping the old lighttpd server installed as it also serves other stuff (e.g. nextcloud). Therefore pihole is now reachable via port 8080 and a slightly changed url.

But now the pihole webserver shares the webroot with lighttpd, so pihole now exposes everything from lighttpd as well. I can reach e.g. http://piholehost:8080/nextcloud/index.php and get the php source of the page.

Debug Token

• URL:

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

[DL6ER]

Please move the nextcloud installation outside of /var/www/html and change the existing lighttpd configuration accordingly.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Please comment or update this issue or it will be closed in 5 days.

[yubiuser]

This PR (#2355) released with v6.1 offers an option to disable serving files outside of /admin/ and /api/