Improve directory protection for Apache 2.4

10 years ago · 585ee9e181
parent 012555c1ce
commit 585ee9e181
4 changed files with 24 additions and 3 deletions
--- a/6
+++ b/6
@ -169,6 +169,12 @@ rewrite rules. In order to properly secure your installation, please enable
 mod_rewrite for Apache webserver and double check access to the above listed
 directories and their contents is denied.

+NOTE: In Apache 2.4, support for .htaccess files has been disabled by
+default. Therefore you first need to enable this in your Apache main or
+virtual host config by with:
+
+ AllowOverride all
+

 UPGRADING
 =========
--- a/config/.htaccess
+++ b/config/.htaccess
@ -1,2 +1,7 @@
 # deny webserver access to this directory
-Deny from all
+<ifModule mod_authz_core.c>
+    Require all denied
+</ifModule>
+<ifModule !mod_authz_core.c>
+    Deny from all
+</ifModule>
--- a/logs/.htaccess
+++ b/logs/.htaccess
@ -1,2 +1,7 @@
 # deny webserver access to this directory
-Deny from all
+<ifModule mod_authz_core.c>
+    Require all denied
+</ifModule>
+<ifModule !mod_authz_core.c>
+    Deny from all
+</ifModule>
--- a/temp/.htaccess
+++ b/temp/.htaccess
@ -1,2 +1,7 @@
 # deny webserver access to this directory
-Deny from all
+<ifModule mod_authz_core.c>
+    Require all denied
+</ifModule>
+<ifModule !mod_authz_core.c>
+    Deny from all
+</ifModule>