Problem/Motivation

We now have a sites/default/services.yml file that has, potentially, sensitive information in it (just as settings.php has). That should not be publicly exposed.

Proposed resolution

Add .yml files to the blacklist in .htaccess.

Remaining tasks

Write the patch. Should be easy.

User interface changes

None.

API changes

None.

Comments

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner commented
Parent issue: » #2251113: Use container parameters instead of settings

.

Crell’s picture

Crell CreditAttribution: Crell commented
Issue summary: View changes
Issue tags: +Novice

This is a one liner patch, so marking Novice.

moshe weitzman’s picture

moshe weitzman CreditAttribution: moshe weitzman commented
Priority: Major » Critical

web.config and .htaccess need updating.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
CreditAttribution: alexpott commented
Status: Active » Closed (duplicate)

This is a duplicate of #1956698: Prevent access to YAML files using .htaccess and web.config