Create .htaccess files at runtime
|Reported by:||vipsoft||Owned by:||vipsoft|
In , .htaccess files were added to core, lang, libs, plugins, and themes to guard against directory listing and direct access to .php and .tpl files. This ascribes to the "secure by default" principle.
It addresses the potential 'information disclosure' vulnerability (i.e., script path or include path) on a misconfigured web server, and avoids the need to add "defined('PIWIK_INCLUDE_PATH') or die;" to .php files (which we started doing in , but not yet for files that contain subclasses).
Unfortunately, some are experiencing problems:
- wrong permissions (when files are uploaded to server)
- "Loading data... oops...an error has occured during the query, please try again." (unless the .htaccess files are removed)
Change History (6)
comment:1 Changed 4 years ago by vipsoft (robocoder)
- Resolution set to fixed
- Status changed from new to closed
comment:4 Changed 4 years ago by vipsoft (robocoder)
- Summary changed from .htaccess files to Create .htaccess files at runtime