nextcloud/config/.htaccess

# Section for Apache 2.4 and 2.5
<ifModule mod_authz_core.c>
  Require all denied
</ifModule>
<ifModule mod_access_compat.c>
  Deny from all
  Satisfy All
</ifModule>

# Section for Apache 2.2
<ifModule !mod_authz_core.c>
  <ifModule !mod_access_compat.c>
    <ifModule mod_authz_host.c>
      Deny from all
    </ifModule>
    Satisfy All
  </ifModule>
</ifModule>

# Section for Apache 2.2 to 2.5
<ifModule mod_autoindex.c>
  IndexIgnore *
</ifModule>
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com> 5 years ago			`# Section for Apache 2.4 and 2.5`
Reference module with `.c` Fixes https://github.com/owncloud/core/issues/13657 9 years ago			`<ifModule mod_authz_core.c>`
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com> 5 years ago			`Require all denied`
			`</ifModule>`
			`<ifModule mod_access_compat.c>`
			`Deny from all`
			`Satisfy All`
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-) 10 years ago			`</ifModule>`

Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com> 5 years ago			`# Section for Apache 2.2`
Reference module with `.c` Fixes https://github.com/owncloud/core/issues/13657 9 years ago			`<ifModule !mod_authz_core.c>`
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com> 5 years ago			`<ifModule !mod_access_compat.c>`
			`<ifModule mod_authz_host.c>`
			`Deny from all`
			`</ifModule>`
			`Satisfy All`
			`</ifModule>`
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-) 10 years ago			`</ifModule>`

Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com> 5 years ago			`# Section for Apache 2.2 to 2.5`
Only request "IndexIgnore" if mod_autoindex is loaded Signed-off-by: Robert Scheck <robert@fedoraproject.org> 7 years ago			`<ifModule mod_autoindex.c>`
Harden config protection .htaccess + Set "Satisfy All" whenever available, as well on Apache 2.4+. This is required to override possible "Satisfy Any" on parent dir, which otherwise would allow direct access to data, regardless of "Require" directive. + Set "Deny from all" as well whenever available, to block access regardless of which access control directive takes priority. + Assume Apache 2.2 only, if mod_authz_core and mod_access_compat are both not available, to avoid doubled directives. In this case set "Deny from all" directive only if the providing mod_authz_host module is available. "Satisfy" is a core directive on Apache 2.2. + Update Apache version strings. Regarding the used directives/modules, Apache 2.4 and 2.5 behave the same. + Add ordering spaces to better reflect the nested directives and to match style of other .htaccess files. Fixes: #6449 (for the config directory) Signed-off-by: Micha Felle <micha@dietpi.com> 5 years ago			`IndexIgnore *`
Only request "IndexIgnore" if mod_autoindex is loaded Signed-off-by: Robert Scheck <robert@fedoraproject.org> 7 years ago			`</ifModule>`