makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-27 04:18:55 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/16556] Remove purposeless <Files "*"> from .htaccess

Browse source 
Wrapping access permissions into <Files "*"> at best has zero effect
and implies unnecessary code and parsing for the web server. At least
it does not block access to files only, but still denies auto indexing
and access to sub directories effectively as well. But removing this
directive is still the cleaner and safer way to deny access to any
kind of resource that is provided within the directory in question.

To deny access to migration data, a single .htaccess file can be used.
This reduces the effort for future changes and it is not required
anymore to create new .htaccess files for every new migration
directory.

Additionally this corrects the fact the "Require" is part of
"mod_authz_core", not "mod_authz_host".

PHPBB3-16556

Signed-off-by: MichaIng <micha@dietpi.com>
This commit is contained in:
MichaIng 2020-07-25 13:26:58 +02:00
parent 98515e7c7d
commit eff277a872
13 changed files with 54 additions and 308 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
phpBB/cache/.htaccess vendored
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>

10
phpBB/config/.htaccess
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>

10
phpBB/files/.htaccess
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>

10
phpBB/images/avatars/upload/.htaccess
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>

10
phpBB/includes/.htaccess
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>

10
phpBB/phpbb/db/migration/data/v30x/.htaccess → phpBB/phpbb/db/migration/data/.htaccess
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>

33
phpBB/phpbb/db/migration/data/v310/.htaccess
View file

@ -1,33 +0,0 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host.
# We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c>
<IfVersion < 2.4>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfVersion>
<IfVersion >= 2.4>
<Files "*">
Require all denied
</Files>
</IfVersion>
</IfModule>
<IfModule !mod_version.c>
<IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfModule>
<IfModule mod_authz_core.c>
<Files "*">
Require all denied
</Files>
</IfModule>
</IfModule>

33
phpBB/phpbb/db/migration/data/v31x/.htaccess
View file

@ -1,33 +0,0 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host.
# We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c>
<IfVersion < 2.4>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfVersion>
<IfVersion >= 2.4>
<Files "*">
Require all denied
</Files>
</IfVersion>
</IfModule>
<IfModule !mod_version.c>
<IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfModule>
<IfModule mod_authz_core.c>
<Files "*">
Require all denied
</Files>
</IfModule>
</IfModule>

33
phpBB/phpbb/db/migration/data/v320/.htaccess
View file

@ -1,33 +0,0 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host.
# We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c>
<IfVersion < 2.4>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfVersion>
<IfVersion >= 2.4>
<Files "*">
Require all denied
</Files>
</IfVersion>
</IfModule>
<IfModule !mod_version.c>
<IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfModule>
<IfModule mod_authz_core.c>
<Files "*">
Require all denied
</Files>
</IfModule>
</IfModule>

33
phpBB/phpbb/db/migration/data/v32x/.htaccess
View file

@ -1,33 +0,0 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host.
# We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c>
<IfVersion < 2.4>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfVersion>
<IfVersion >= 2.4>
<Files "*">
Require all denied
</Files>
</IfVersion>
</IfModule>
<IfModule !mod_version.c>
<IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfModule>
<IfModule mod_authz_core.c>
<Files "*">
Require all denied
</Files>
</IfModule>
</IfModule>

33
phpBB/phpbb/db/migration/data/v330/.htaccess
View file

@ -1,33 +0,0 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host.
# We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c>
<IfVersion < 2.4>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfVersion>
<IfVersion >= 2.4>
<Files "*">
Require all denied
</Files>
</IfVersion>
</IfModule>
<IfModule !mod_version.c>
<IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfModule>
<IfModule mod_authz_core.c>
<Files "*">
Require all denied
</Files>
</IfModule>
</IfModule>

33
phpBB/phpbb/db/migration/data/v33x/.htaccess
View file

@ -1,33 +0,0 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host.
# We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c>
<IfVersion < 2.4>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfVersion>
<IfVersion >= 2.4>
<Files "*">
Require all denied
</Files>
</IfVersion>
</IfModule>
<IfModule !mod_version.c>
<IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny
Deny from All
</Files>
</IfModule>
<IfModule mod_authz_core.c>
<Files "*">
Require all denied
</Files>
</IfModule>
</IfModule>

10
phpBB/store/.htaccess
View file

@ -1,33 +1,25 @@
# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
# module mod_authz_host to a new module called mod_access_compat (which may be # module mod_authz_host to a new module called mod_access_compat (which may be
# disabled) and a new "Require" syntax has been introduced to mod_authz_host. # disabled) and a new "Require" syntax has been introduced to mod_authz_core.
# We could just conditionally provide both versions, but unfortunately Apache # We could just conditionally provide both versions, but unfortunately Apache
# does not explicitly tell us its version if the module mod_version is not # does not explicitly tell us its version if the module mod_version is not
# available. In this case, we check for the availability of module # available. In this case, we check for the availability of module
# mod_authz_core (which should be on 2.4 or higher only) as a best guess. # mod_authz_core (which should be on 2.4 or higher only) as a best guess.
<IfModule mod_version.c> <IfModule mod_version.c>
<IfVersion < 2.4> <IfVersion < 2.4>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfVersion> </IfVersion>
<IfVersion >= 2.4> <IfVersion >= 2.4>
<Files "*">
Require all denied Require all denied
</Files>
</IfVersion> </IfVersion>
</IfModule> </IfModule>
<IfModule !mod_version.c> <IfModule !mod_version.c>
<IfModule !mod_authz_core.c> <IfModule !mod_authz_core.c>
<Files "*">
Order Allow,Deny Order Allow,Deny
Deny from All Deny from All
</Files>
</IfModule> </IfModule>
<IfModule mod_authz_core.c> <IfModule mod_authz_core.c>
<Files "*">
Require all denied Require all denied
</Files>
</IfModule> </IfModule>
</IfModule> </IfModule>