Improve directory protection for Apache 2.4

roundcube · May 7, 2015 · 585ee9e · 585ee9e
1 parent 012555c
commit 585ee9e
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 3 deletions.
diff --git a/INSTALL b/INSTALL
@@ -169,6 +169,12 @@ rewrite rules. In order to properly secure your installation, please enable
 mod_rewrite for Apache webserver and double check access to the above listed
 directories and their contents is denied.
 
+NOTE: In Apache 2.4, support for .htaccess files has been disabled by
+default. Therefore you first need to enable this in your Apache main or
+virtual host config by with:
+
+ AllowOverride all
+
 
 UPGRADING
 =========

diff --git a/config/.htaccess b/config/.htaccess
@@ -1,2 +1,7 @@
 # deny webserver access to this directory
-Deny from all
+<ifModule mod_authz_core.c>
+    Require all denied
+</ifModule>
+<ifModule !mod_authz_core.c>
+    Deny from all
+</ifModule>
diff --git a/logs/.htaccess b/logs/.htaccess
@@ -1,2 +1,7 @@
 # deny webserver access to this directory
-Deny from all
+<ifModule mod_authz_core.c>
+    Require all denied
+</ifModule>
+<ifModule !mod_authz_core.c>
+    Deny from all
+</ifModule>
diff --git a/temp/.htaccess b/temp/.htaccess
@@ -1,2 +1,7 @@
 # deny webserver access to this directory
-Deny from all
+<ifModule mod_authz_core.c>
+    Require all denied
+</ifModule>
+<ifModule !mod_authz_core.c>
+    Deny from all
+</ifModule>