D7 port of #2948579: Block web.config in .htaccess (and vice-versa)

CommentFileSizeAuthor
#4 interdiff-3047412-3-4.txt890 bytesmcdruid
#4 3047412-4.patch1.66 KBmcdruid
#3 interdiff-3047412-1-3.txt901 bytesmcdruid
#3 3047412-3.patch1.67 KBmcdruid
#2 3047412-1.patch1.67 KBmcdruid

Comments

mcdruid created an issue. See original summary.

mcdruid’s picture

mcdruid commented
Status: Active » Needs review
StatusFileSize
new 3047412-1.patch1.67 KB

Apache before:

$ curl -SLIXGET drupal7x.xp/web.config
HTTP/1.1 200 OK
Date: Thu, 11 Apr 2019 12:29:19 GMT
Server: Apache/2.4.18 (Ubuntu)
X-Content-Type-Options: nosniff
Last-Modified: Thu, 11 Apr 2019 12:29:17 GMT
Accept-Ranges: bytes
Content-Length: 2200
Cache-Control: max-age=1209600
Expires: Thu, 25 Apr 2019 12:29:19 GMT

...and after:

$ curl -SLIXGET drupal7x.xp/web.config
HTTP/1.1 403 Forbidden
Date: Thu, 11 Apr 2019 12:29:14 GMT
Server: Apache/2.4.18 (Ubuntu)
X-Content-Type-Options: nosniff
Content-Length: 296
Content-Type: text/html; charset=iso-8859-1

Need to test on IIS.

mcdruid’s picture

mcdruid commented
StatusFileSize
new 3047412-3.patch1.67 KB
new interdiff-3047412-1-3.txt901 bytes

Adding the slash to web\.config in the web.config file per @rabbitlair in #2948579-25: Block web.config in .htaccess (and vice-versa).

mcdruid’s picture

mcdruid commented
StatusFileSize
new 3047412-4.patch1.66 KB
new interdiff-3047412-3-4.txt890 bytes

Same change as last patch in the parent/D8 issue; removing the web.config rule from the web.config file so that the two webservers are only blocking each other's config files.

This was just committed to D8 so I'm going to mark it RTBC if the tests pass here.

mcdruid’s picture

mcdruid commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Drupal 7.66 target
beckydev’s picture

beckydev commented

Tested patch in #4 from an Apache environment. Confirmed web.config is no longer served up (403), +1 RTBC.

mcdruid’s picture

mcdruid commented
Issue tags: -Drupal 7.66 target +Drupal 7.68 target
joseph.olstad’s picture

joseph.olstad
Primary language French
commented
Related issues: +#3088836: Rejuvenate D7, a need for more time spent committing and RTBCing Drupal 7 issues
joseph.olstad’s picture

joseph.olstad
Primary language French
commented
Related issues: -#3088836: Rejuvenate D7, a need for more time spent committing and RTBCing Drupal 7 issues
mcdruid’s picture

mcdruid commented
Issue tags: +Already In D8, +Pending Drupal 7 commit

n.b. we need to update issue credit here based on the D8 parent when this is committed.

fabianx’s picture

fabianx commented

RTBM (ready to be merged)

Please go ahead and commit this.

mcdruid credited Chi.

mcdruid credited DKAN.

mcdruid credited alexpott.

mcdruid credited greggles.

mcdruid credited interX.

mcdruid credited longwave.

mcdruid credited rabbitlair.

mcdruid credited sammuell.

mcdruid’s picture

mcdruid commented

Adding issue credit from the D8 parent issue #2948579: Block web.config in .htaccess (and vice-versa).

  • mcdruid committed 758ed4b on 7.x 
    Issue #3047412 by mcdruid, Chi, beckydev, DKAN, alexpott, sammuell,...
mcdruid’s picture

mcdruid commented
Status: Reviewed & tested by the community » Fixed

Thank you everyone that contributed!

mcdruid’s picture

mcdruid commented
Issue tags: -Pending Drupal 7 commit
joseph.olstad’s picture

joseph.olstad
Primary language French
commented

Thumbs up!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.