search

YunoHost-Apps / pluxml_ynh

PluXml package for YunoHost
http://pluxml.org
GNU General Public License v3.0
9 stars 4 forks source link

Move data directory to /home/yunohost.app/pluxml #7

Closed julienmalik closed 9 years ago

julienmalik commented 9 years ago

Currently there is a big security flaw. You access all the data dir from your browser. This is because .htaccess are apache-only, and nginx does not do anything with them.

A solution would be to move data to /home/yunohost.app/pluxml

julienmalik commented 9 years ago

I tried quickly but the PluXML code does not seem to be prepared for having data outside the www dir.

Another option is to deny the data dir directly in nginx conf, which I provided in https://github.com/matlink/pluxml_ynh/pull/6

matlink commented 9 years ago

Nginx restricts the data folder