Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

.htaccess hardening #5621

Merged
merged 12 commits into from Jun 16, 2017
Merged

.htaccess hardening #5621

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
6f7a4bf
Ignore .htaccess
DaazKu May 25, 2017
b393ce0
.htaccess hardening + remove deprecated p paramter
DaazKu May 25, 2017
30c4b0a
Properly ignore .htaccess
DaazKu May 25, 2017
1fd6749
Prevent access to certain directory
DaazKu May 25, 2017
3a3cf29
Remove useless .gitkeep files
DaazKu May 25, 2017
614d5d5
Remove useless QSA flag
DaazKu May 25, 2017
0766d79
Add inline documentation about allowing other php script to run
DaazKu May 25, 2017
20a2d5d
Remove debug code from index.php
DaazKu May 26, 2017
c5e1e70
Update comment
DaazKu May 26, 2017
31273c7
Simplify hardening rules
DaazKu May 26, 2017
08159b2
Correctly emphasis SHOULD NOT
DaazKu Jun 2, 2017
de02ca2
Remove unused code
DaazKu Jun 13, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 8 additions & 5 deletions .gitignore
View file
Open in desktop
Expand Up @@ -2,9 +2,15 @@
!/applications/conversations/
!/applications/dashboard/
!/applications/vanilla/
/build/*
!/build/.htaccess
!/build/build.xml
!/build/package-include.txt
!/build/package-exclude.txt
/cache/*
!/cache/.gitkeep
!/cache/.htaccess
/conf/*
!/conf/.htaccess
!/conf/config-defaults.php
!/conf/constants.php
!/conf/readme.txt
Expand Down Expand Up @@ -55,6 +61,7 @@ _notes
*/_archive/*
~*
composer-local.json
/.htaccess
.project
.settings
.buildpath
Expand All @@ -64,10 +71,6 @@ composer-local.json
node_modules/
bower_components/
npm-debug.log
/build/*
!/build/build.xml
!/build/package-include.txt
!/build/package-exclude.txt
/tests/cache/
/cgi-bin/
phpunit.xml
41 changes: 29 additions & 12 deletions .htaccess.dist
View file
Open in desktop
Expand Up @@ -4,33 +4,50 @@
<IfModule mod_rewrite.c>
RewriteEngine On

####
# Certain hosts may require the following line.
# If vanilla is in a subfolder then you need to specify it after the /.
# (ex. You put Vanilla in /forum so change the next line to: RewriteBase /forum)
# RewriteBase /
####
#RewriteBase /

RewriteCond %{QUERY_STRING} ^p=/?([^&]+)(&([^?]+))?$
RewriteRule ^index\.php %1?%3 [E=X_REWRITE:1,L]
####
# Deny access to certain directories that SHOULD NOT be exposed.
####
RewriteRule (^|/)\.git - [L,R=403]
RewriteRule ^cache/ - [L,R=403]
RewriteRule ^cgi-bin/ - [L,R=403]
RewriteRule ^uploads/import/ - [L,R=403]
RewriteRule ^vendor/ - [L,R=403]

# The basic rewrite rule.
####
# Prevent access to any php script by redirecting the request to /index.php
# You can add an exceptions by adding another RewriteCond after this one.
# Example: RewriteCond %{REQUEST_URI} !^/yourscriptname.php$
# You can comment out this section if it causes you problems.
# This is just a nice to have for security purposes.
####
RewriteCond %{REQUEST_URI} !^/index.php$
RewriteRule ^(.+\.php)$ index.php [E=X_REWRITE:1,E=X_PATH_INFO:/$1,L]

####
# Redirect any non existing file/directory to /index.php
####
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [QSA,E=X_REWRITE:1,E=X_PATH_INFO:/$1,L]
RewriteRule ^(.*)$ index.php [E=X_REWRITE:1,E=X_PATH_INFO:/$1,L]

####
# Add the proper X_REWRITE server variable for rewritten requests.
####
RewriteCond %{ENV:REDIRECT_X_REWRITE} .+
RewriteCond %{ENV:REDIRECT_X_PATH_INFO} (.+)
RewriteRule ^index\.php - [QSA,E=X_REWRITE:1,E=!REDIRECT_X_REWRITE,E=X_PATH_INFO:%1,E=!REDIRECT_X_PATH_INFO,L]

# 301 redirect urls that start with index.php
#RewriteCond %{REQUEST_METHOD} GET [NC]
#RewriteCond %{REQUEST_URI} ^(.*?)/index\.php(.*)$
#RewriteRule ^index\.php /%1%2 [QSA,R,L]
RewriteRule ^index\.php - [E=X_REWRITE:1,E=!REDIRECT_X_REWRITE,E=X_PATH_INFO:%1,E=!REDIRECT_X_PATH_INFO,L]
</IfModule>

<IfModule mod_headers.c>
<FilesMatch "(?<!embed)\.(css|js|woff|ttf|eot|svg|png|gif|jpeg|jpg|ico|swf)$">
Header set Cache-Control "max-age=315360000"
Header set Expires "31 December 2037 23:59:59 GMT"
</FilesMatch>
</IfModule>
</IfModule>
1 change: 1 addition & 0 deletions build/.htaccess
View file
Open in desktop
@@ -0,0 +1 @@
Deny from all
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's common for hosts to ignore .htaccess files that aren't in the root directory. What's the rationale for splitting this off?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/tests already have an .htaccess I just copied the behaviour.

I added the commented rules in the case someone preferred not to use the .htaccess (which is faster I think)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That being said should I uncomment them?

Copy link
Contributor

@linc linc Jun 8, 2017 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd delete the redundant lines in the main htaccess entirely.

These directories should never, ever make it to production. The sub-.htaccess files being here is already a backup. Double-backing it up by also having comments in the main htaccess seems like tacit approval of this massive screwup because someone would have to opt into it, at which point what the hell are they even doing?

Empty file removed cache/.gitkeep
View file
Open in desktop
Empty file.
1 change: 1 addition & 0 deletions cache/.htaccess
View file
Open in desktop
@@ -0,0 +1 @@
Deny from all
Empty file removed cache/Smarty/.gitkeep
View file
Open in desktop
Empty file.
1 change: 1 addition & 0 deletions conf/.htaccess
View file
Open in desktop
@@ -0,0 +1 @@
Deny from all