Your authdb is downloadable. Please secure your install

[it-ngo]

I installed nsedit using the github article. https://github.com/tuxis-ie/nsedit

• pdns.users.sqlite3 is located under / etc / nsedit
• in the config.inc.php I refer to the path
• Rights for folders d --- rwx --- 2 root www-data 4096 Jan 24 15:06 nsedit
• rights for the files in the folder d --- rwx --- 2 root www-data 4096 Jan 24 15:06. drwxr-xr-x 100 root root 4096 Jan 24 14:56 .. -rw-rw ---- 1 root www-data 0 Jan 24 15:01 log -rw-rw ---- 1 root www-data 28672 Jan 24 15:06 pdns.users.sqlite3

I give less rights to the file or folder. If the error message comes he can not find the file. I give the file or folder the specified rights, the error comes as in the title description.

Where is my thought error. What do I have to do differently?

In my opinion, it is not possible to access a web page in the /etc folder.

I know this problem of Own or Nextcloud, because I put the data folder in the /var directory.

Please help

[it-ngo]

any ideas?

[chessmango]

Same issue here - doesn't seem to matter where I keep my authdb, it's detected as downloadable. /home/myuser is definitely not a directory served by my httpd.

[tuxis-ie]

I’ll try to look into this this weekend.

Mark Schouten

Op 2 feb. 2019 om 15:49 heeft Owen Valentine notifications@github.com het volgende geschreven:

Same issue here - doesn't seem to matter where I keep my authdb, it's detected as downloadable. /home/myuser is definitely not a directory served by my httpd.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[it-ngo]

Further key data:

Ubuntu 18.04 LTS apache2 PHP 7.2

[tuxis-ie]

The check is executed here: https://github.com/tuxis-ie/nsedit/blob/master/index.php#L39

If you use the webdeveloper feature in your browser, you should be able to see the request executed. Can you check what the results of that webrequest is?

[it-ngo]

If ReadyState = 1 Then Reader.Status = 0

If ReadyState = 2 Then Reader.Status = 200

If ReadyState = 3 Then Reader.Status = 200

If ReadyState = 4 Then Reader.Status = 200 And then comes the alert

[it-ngo]

How does it look? Is this a hoax, so I can circumvent the area of the source text until the repair first?

[it-ngo]

Hello??

[WilliamDEdwards]

Hello??

Check your web server config. If HTTP is used to do the authdb request test while you are requesting the page with HTTPS, NSedit falsely reports back that your authdb is downloadable.

[it-ngo]

we use a Sophos firewall which we publish over. between firewall and NSedit everything runs over http. What do I need to look for in my web server config?

[WilliamDEdwards]

we use a Sophos firewall which we publish over. between firewall and NSedit everything runs over http. What do I need to look for in my web server config?

It would appear you are not changing the headers to the right protocol.

[detuur]

For me the PHP broke somehow so it was just making a request for my base host URL. So of course that succeeded. I deleted the javascript section out of index.php since I properly secured my install with an authdb that is definitely not served by my httpd.

[jduijm]

You can also set the $testpath variable to the following (index.php). So that the basename is only replaced when there is actually something to replace

$testpath = !empty(basename($_SERVER['REQUEST_URI'])) ? str_replace(basename($_SERVER['REQUEST_URI']), $authdb, $_SERVER['REQUEST_URI']) : '/' . $authdb;