Hi there,

I've had a client, after running a security audit on their site, file a security ticket with us:

49964124 Predictable Resource Location [scratched]/profiles/panopoly/build.xml

Meaning that the audit tool they used flagged this file as something that shouldn't be publicly viewable. Looking at the contents, I don't think there's anything terribly bad about this, but if standard security tools are flagging this, then maybe it's an issue.

This appears to be part of the phing build system. Can we add an .htaccess deny directive to this file in the panopoly profile? I'm assuming it's not actually called by Apache during the build. Let me know if you'd accept a patch.

Thanks,
Shiraz

CommentFileSizeAuthor
#3 panopoly-hide_phing_build_file-2655260-7.x.patch274 bytesshiraz dindar

Comments

Shiraz Dindar created an issue. See original summary.

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented

Yeah, that should be harmless. :-/

But I'd be happy to accept a patch to add an .htaccess to hide it. :-)

shiraz dindar’s picture

shiraz dindar
Location Sooke, BC
commented
StatusFileSize
new panopoly-hide_phing_build_file-2655260-7.x.patch274 bytes

Agreed re: no-risk, but thanks for accepting the patch! Just makes my life a bit easier.

It's Dave, right? Thanks again.

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented
Status: Active » Fixed

Great, thanks! Committed! :-)

  • dsnopek committed bba0d0d on 7.x-1.x authored by Shiraz Dindar 
    Issue #2655260 by Shiraz Dindar: phing build exposes too much to the...
shiraz dindar’s picture

shiraz dindar
Location Sooke, BC
commented

Thank you!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.