The file name *.tags are accessible on web. They will have to rename '*.tags' to '*.tags.inc' for security reason.

CommentFileSizeAuthor
#1 reptag_tags_inc.patch1.88 KBprofix898

Comments

profix898’s picture

profix898 commented
Status: Active » Needs review
StatusFileSize
new reptag_tags_inc.patch1.88 KB

Not sure this is really necassary. The .tags files do not contain any vital information (no personal data or site-related content). Who ever is interested in the code can download the module from drupal.org ... the only detail someone can get is the fact that the reptag files are present, but you can find out by accessing reptag/images/* also.

There are 3 options to prevent access to .tags files though:
1. manually add .tags to Drupal's .htaccess
2. rename .tags in .tags.inc to tag advantage of .inc being protected already
3. add an additional .htaccess in reptag/tags folder to block access completely

I'm a little indecisive what way to go ... however attached is a patch which makes reptag compatible with .tags.inc extension. You must rename the .tags file to .tags.inc manually, apply the patch and visit update.php to update the module registry ... I didnt have time for in-depth testing, but it should work ...

Takafumi’s picture

Takafumi commented

Certainly, it is not necessarily required. However, the same is equally true of *.info(or, some extensions hide by .htaccess in the core) file.

To reduce the security risk as much as possible, I suggested it.

profix898’s picture

profix898 commented
Status: Needs review » Fixed

Patch committed to Drupal-5 branch and '.tags' files renamed to '.tags.inc'. Thanks.

Takafumi’s picture

Takafumi commented
Status: Fixed » Closed (fixed)

thanks.