X Tutup
Skip to content

Commit 35c7d41

Browse files
author
David Christofas
committed
tweak rewrite conditions in htaccess
This change hardens the rewrite rules to match the exact paths we want and not any subpaths e.g. `/somefolder/status.php`. Thanks to Terry Franklin, Matt Harris, Hayden Barker and Colin Smith (aka yoloClin) from Radiant Security (https://radiant.security) for reporting this.
1 parent 7753fcd commit 35c7d41

File tree

2 files changed

+19
-14
lines changed

2 files changed

+19
-14
lines changed

‎changelog/unreleased/tweak-htaccess.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Enhancement: Tweak rewrite conditions in .htaccess
2+
3+
Changed the RewriteCond rules in the `.htaccess` file to match the expected paths.
4+
5+
https://github.com/owncloud/core/pull/40584

‎lib/private/Setup.php‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -497,20 +497,20 @@ public static function updateHtaccess() {
497497
$content .= "\n RewriteRule ^favicon.ico$ core/img/favicon.ico [L]";
498498
$content .= "\n RewriteRule ^core/js/oc.js$ index.php [PT,E=PATH_INFO:$1]";
499499
$content .= "\n RewriteRule ^core/preview.png$ index.php [PT,E=PATH_INFO:$1]";
500-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !\\.(css|js|svg|gif|png|html|ttf|woff|ico|jpg|jpeg|json|properties)$";
501-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !core/img/favicon.ico$";
502-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/robots.txt";
503-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/remote.php";
504-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/public.php";
505-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/cron.php";
506-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/core/ajax/update.php";
507-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/status.php";
508-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/ocs/v1.php";
509-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/ocs/v2.php";
510-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/updater/";
511-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/ocs-provider/";
512-
$content .= "\n RewriteCond %{REQUEST_FILENAME} !/ocm-provider/";
513-
$content .= "\n RewriteCond %{REQUEST_URI} !^/.well-known/(acme-challenge|pki-validation)/.*";
500+
$content .= "\n RewriteCond %{REQUEST_URI} !\\.(css|js|svg|gif|png|html|ttf|woff|ico|jpg|jpeg|json|properties)$";
501+
$content .= "\n RewriteCond %{REQUEST_URI} !^/core/img/favicon\\.ico$";
502+
$content .= "\n RewriteCond %{REQUEST_URI} !^/robots\\.txt$";
503+
$content .= "\n RewriteCond %{REQUEST_URI} !^/remote\\.php";
504+
$content .= "\n RewriteCond %{REQUEST_URI} !^/public\\.php";
505+
$content .= "\n RewriteCond %{REQUEST_URI} !^/cron\\.php";
506+
$content .= "\n RewriteCond %{REQUEST_URI} !^/core/ajax/update\\.php";
507+
$content .= "\n RewriteCond %{REQUEST_URI} !^/status\\.php$";
508+
$content .= "\n RewriteCond %{REQUEST_URI} !^/ocs/v1\\.php";
509+
$content .= "\n RewriteCond %{REQUEST_URI} !^/ocs/v2\\.php";
510+
$content .= "\n RewriteCond %{REQUEST_URI} !^/updater/";
511+
$content .= "\n RewriteCond %{REQUEST_URI} !^/ocs-provider/";
512+
$content .= "\n RewriteCond %{REQUEST_URI} !^/ocm-provider/";
513+
$content .= "\n RewriteCond %{REQUEST_URI} !^/\\.well-known/(acme-challenge|pki-validation)/.*";
514514
$content .= "\n RewriteRule . index.php [PT,E=PATH_INFO:$1]";
515515
$content .= "\n RewriteBase " . $rewriteBase;
516516
$content .= "\n <IfModule mod_env.c>";

0 commit comments

Comments
 (0)
X Tutup