Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create .htaccess files at runtime #1337

Closed
robocoder opened this issue May 6, 2010 · 5 comments
Closed

Create .htaccess files at runtime #1337

robocoder opened this issue May 6, 2010 · 5 comments
Assignees
@robocoder
Labels
Bug For errors / faults / flaws / inconsistencies etc.
Milestone
0.6.1

Comments

@robocoder
Copy link
Contributor

In [1743], .htaccess files were added to core, lang, libs, plugins, and themes to guard against directory listing and direct access to .php and .tpl files. This ascribes to the "secure by default" principle.

It addresses the potential 'information disclosure' vulnerability (i.e., script path or include path) on a misconfigured web server, and avoids the need to add "defined('PIWIK_INCLUDE_PATH') or die;" to .php files (which we started doing in [1335], but not yet for files that contain subclasses).

Unfortunately, some are experiencing problems:

  • wrong permissions (when files are uploaded to server)
  • "Loading data... oops...an error has occured during the query, please try again." (unless the .htaccess files are removed)
@robocoder
Copy link
Contributor Author

(In [2147]) fixes #1337 - remove static .htaccess files and defined('PIWIK_INCLUDE_PATH') or die "guard"; we'll enhance PhpSecInfo to assist the user in configuring their environment more securely

@robocoder
Copy link
Contributor Author

(In [2148]) refs #1337

@robocoder
Copy link
Contributor Author

(In [2149]) refs #1337 - create .htaccess files at runtime (Installation); tested with Order deny,allow (and allow,deny), AllowOverride All (vs none)

@robocoder
Copy link
Contributor Author

(In [2223]) refs #1337 - allow direct access to .test.php files

@robocoder
Copy link
Contributor Author

(In [2315]) refs #1337 - only create .htaccess files at Installation if Apache detected. Jetty's HTAccessHandler doesn't fully support Apache .htaccess files.

@robocoder robocoder added this to the Piwik 0.6.1 milestone Jul 8, 2014
@robocoder robocoder self-assigned this Jul 8, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@robocoder robocoder

Labels
Bug For errors / faults / flaws / inconsistencies etc.
Projects
None yet
Milestone
0.6.1
Development

No branches or pull requests
1 participant
@robocoder