search

H2CK / webtrees

Docker Image containing Webtrees
Apache License 2.0
36 stars 9 forks source link

Internal webtrees directories are exposed #17

Closed kgawda closed 4 years ago

kgawda commented 4 years ago

Some directories that are not expected to be published are available via browser.

Steps to reproduce:

  1. Prepare a database container called "mysql"
  2. Launch container docker run -d -p 8443:443 --name webtrees --link mysql:db dtjs48jkt/webtrees:v2.0.5-1
  3. Open https://localhost:8443 in browser, set up: database details, user and example tree
  4. Open https://localhost:8443/data/config.ini.php. A semicolon is displayed.

According to Webtrees github:

In the unlikely event you do fetch the file (you will just see a semicolon), then that protection is not working on your site and you should take some further action.

H2CK commented 4 years ago

This should be fixed with PR #18 The release version will be v2.0.5-2.

H2CK commented 4 years ago

Docker Image v2.0.5-2 is available on docker hub. Thank you for your contribution.