nextcloud/lib
MichaIng dcbf8fa8e3
Harden data protection .htaccess
+ Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive.
+ Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority.
+ Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2.
+ Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same.
+ Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files.

Fixes: https://github.com/nextcloud/server/issues/6449

Signed-off-by: Micha Felle <micha@dietpi.com>
2019-08-19 15:09:44 +02:00
..
composer Get the proper UID 2019-08-13 09:33:46 +02:00
l10n [tx-robot] updated from transifex 2019-08-19 02:14:56 +00:00
private Harden data protection .htaccess 2019-08-19 15:09:44 +02:00
public frame-src doesn't respect the nonce attribute 2019-08-16 21:29:57 +02:00
autoloader.php move log constants to ILogger 2018-04-26 10:45:52 +02:00
base.php Remove deleted groups from app restrictions fixes #15823 2019-06-27 20:17:50 +02:00
versioncheck.php NC16 is php >= 7.1 2018-12-21 16:04:11 +01:00