Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mcdruid created an issue. See original summary.

mcdruid’s picture

Status: Active » Needs review
FileSize
1.67 KB

Apache before:

$ curl -SLIXGET drupal7x.xp/web.config
HTTP/1.1 200 OK
Date: Thu, 11 Apr 2019 12:29:19 GMT
Server: Apache/2.4.18 (Ubuntu)
X-Content-Type-Options: nosniff
Last-Modified: Thu, 11 Apr 2019 12:29:17 GMT
Accept-Ranges: bytes
Content-Length: 2200
Cache-Control: max-age=1209600
Expires: Thu, 25 Apr 2019 12:29:19 GMT

...and after:

$ curl -SLIXGET drupal7x.xp/web.config
HTTP/1.1 403 Forbidden
Date: Thu, 11 Apr 2019 12:29:14 GMT
Server: Apache/2.4.18 (Ubuntu)
X-Content-Type-Options: nosniff
Content-Length: 296
Content-Type: text/html; charset=iso-8859-1

Need to test on IIS.

mcdruid’s picture

Adding the slash to web\.config in the web.config file per @rabbitlair in #2948579-25: Block web.config in .htaccess (and vice-versa).

mcdruid’s picture

FileSize
1.66 KB
890 bytes

Same change as last patch in the parent/D8 issue; removing the web.config rule from the web.config file so that the two webservers are only blocking each other's config files.

This was just committed to D8 so I'm going to mark it RTBC if the tests pass here.

mcdruid’s picture

Status: Needs review » Reviewed & tested by the community
Issue tags: +Drupal 7.66 target
beckydev’s picture

Tested patch in #4 from an Apache environment. Confirmed web.config is no longer served up (403), +1 RTBC.

mcdruid’s picture

Issue tags: -Drupal 7.66 target +Drupal 7.68 target
joseph.olstad’s picture

joseph.olstad’s picture

mcdruid’s picture

Issue tags: +Already In D8, +Pending Drupal 7 commit

n.b. we need to update issue credit here based on the D8 parent when this is committed.

Fabianx’s picture

RTBM (ready to be merged)

Please go ahead and commit this.

mcdruid credited Chi.

mcdruid credited DKAN.

mcdruid credited alexpott.

mcdruid credited greggles.

mcdruid credited interX.

mcdruid credited longwave.

mcdruid credited sammuell.

mcdruid’s picture

Adding issue credit from the D8 parent issue #2948579: Block web.config in .htaccess (and vice-versa).

  • mcdruid committed 758ed4b on 7.x
    Issue #3047412 by mcdruid, Chi, beckydev, DKAN, alexpott, sammuell,...
mcdruid’s picture

Status: Reviewed & tested by the community » Fixed

Thank you everyone that contributed!

mcdruid’s picture

Issue tags: -Pending Drupal 7 commit
joseph.olstad’s picture

Thumbs up!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.