By index.php with the following contents in every directory, directory browsing is disabled without depending on specific http server configuration.

http://www.site.tld/ should probably be replaced by a variable that contain the site name as provided in the installation

/* Redirect to the base page, effectively disable directory contents listing */
header('Location: http://www.site.tld/');
CommentFileSizeAuthor
index.php.txt136 bytesJPL-1

Comments

JPL-1’s picture

JPL-1 commented

in response to http://drupal.org/node/244642

VinceW’s picture

VinceW commented
Status: Active » Closed (won't fix)

LS,

After taking over maintainership of this module (see: #507278: Request to take over ownership of Security) I'm cleaning up the issue queue.

I won't fix this issue because it's outside the scope of the project (which is analyzing the site and reporting the Security Information) and not applying security patches for core or modules.

If on the other hand one could come up with something to inform the security.module of this risk, your welcome to open a feature request :-)

Best,
VinceW

-=[ Your Information Matters ]=-