[2010-07-15] IIS allows access to various PHP scripts that shouldn't be allowed

[silverstripe-issues]

created by: @halkyon (sharvey)
assigned to: @halkyon (sharvey)
created at: 2010-07-15
original ticket: http://open.silverstripe.org/ticket/5835

---

In cms, sapphire, there's an .htaccess file which blocks access to various PHP scripts for security reasons.

IIS is a popular web server, so having a web.config that does the equivalent of this out of the box might be a good idea too.

e.g. http://localhost/ss24/cms/_config.php should not be allowed on IIS.

It's unclear whether IIS supports blocking requests by extension, but there should be some sort of request filtering that could achieve the same effect as the current .htaccess files in the cms and sapphire directories.

[tractorcow]

In framework all .php files need to be whitelisted.

See https://github.com/silverstripe/silverstripe-framework/blob/3.1/web.config

We should add this to cms as well.

[dhensby]

is this done?

[tractorcow]

No, and this is very easily done. Triaging and assigning to v3.

[chillu]

Now that all core modules are placed in vendor, and vendor access is denied by default, it's only a problem for modules that haven't made the switch to silverstripe-vendormodule yet. It's still an issue for SS3. But overall, it's much lower impact now (now impact/critical)

[sminnee]

I would assume that the fix or this (slated for 4.1) is to move the webroot to a subfolder. As such I think that this bug as covered by #7419 and we can close this.