search

afterlogic / webmail-lite

AfterLogic WebMail Lite PHP. Fast and easy-to-use webmail front-end for your existing IMAP mail server, Plesk or cPanel.
https://afterlogic.org/webmail-lite
GNU Affero General Public License v3.0
444 stars 120 forks source link

Create .htaccess #95

Closed EHCanadian closed 5 years ago

EHCanadian commented 5 years ago

Add Deny from all. Without this file present, anyone can view the database settings located in settings.xml & settings.xml.bak Thou Apache 2.4 will Error 500 because of the directive changes. Its a better solution than allowing http access to the contents.

Likely to be abused by exploit crawlers

afterlogic-support commented 5 years ago

The file is actually there under data directory, which should be sufficient. Thank you.

EHCanadian commented 5 years ago

htaccess files are per directory base. While the /data/.htaccess exists /data/settings/settings.xml can be directly viewed since it does not contain a .htaccess file.

afterlogic-support commented 5 years ago

By default, unless that's explicitly reconfigured on webserver that way, .htaccess applies to current directory and all subdirectories. But we believe it's no harm to place the file into settings/ subdirectory as well.