Aleksander Machniak
|
e71de17602
|
Add note about need for module name change in IfModule when using PHP7 (#5249)
|
8 years ago |
|
Aleksander Machniak
|
614f4413ae
|
Remove useless directives
|
8 years ago |
|
Aleksander Machniak
|
bf19fe2d1a
|
Move commented mod_headers settings to the end of the file
|
8 years ago |
|
Rotzbua
|
7b4f71777e
|
add optional security header to .htaccess
actually most widely used optional header
all options only commented, they should be adusted to your intallation /
user environment
|
9 years ago |
|
Aleksander Machniak
|
1c2aad89ab
|
Fix .htaccess rewrite rules to not block .well-known URIs (#1490615)
|
9 years ago |
|
Aleksander Machniak
|
26086981a2
|
Improve randomness of security tokens (#1490529)
|
9 years ago |
|
Aleksander Machniak
|
348c53b136
|
Add example of setting CSP's no-referer policy
|
9 years ago |
|
Aleksander Machniak
|
e2bceaefe6
|
Support more secure hashing algorithms for auth cookie - configurable by PHP's session.hash_function (#1490403)
|
9 years ago |
|
Aleksander Machniak
|
0b9b9f63b5
|
Enable FollowSymLinks option in .htaccess file which is required by rewrite rules (#1490255)
|
10 years ago |
|
Raoul Bhatia
|
fd0583a846
|
Explicitly deny access to newly created "Dockerfile"
|
10 years ago |
|
Aleksander Machniak
|
681ba6fc3c
|
Improve system security by using optional special URL with security token
Allows to define separate server/path for image/js/css files
Fix bugs where CSRF attacks were still possible on some requests
|
10 years ago |
|
Aleksander Machniak
|
6b7e06620d
|
Remove zend.ze1_compatibility_mode checks, it does not exist in PHP >= 5.3
|
10 years ago |
|
Aleksander Machniak
|
93e12fa414
|
Support upload progress with session.upload_progress and PECL uploadprogress module (#1488702)
|
10 years ago |
|
Aleksander Machniak
|
4c7a980aaa
|
Convert tabs to spaces
|
10 years ago |
|
Aleksander Machniak
|
0314bff278
|
Set register_globals=off in .htaccess file and add note to INSTALL
|
10 years ago |
|
Aleksander Machniak
|
2dade15d83
|
Fix security rules in .htaccess preventing access to base URL without the ending slash (#1489477)
|
11 years ago |
|
Aleksander Machniak
|
88934b6132
|
Keep all security rules in one place, support Apache 2.4 syntax
|
11 years ago |
|
Raoul Bhatia
|
cb3ea1443e
|
Deny access to all files not containing a . (dot) to block access to different README, ChangeLog, etc. files of various skins and plugins.
Do not check case for default README/INSTALL/LICENE files.
|
11 years ago |
|
Aleksander Machniak
|
1c51d16eb3
|
- Fix rewrite rule in .htaccess (#1489240)
|
11 years ago |
|
Dennis1993
|
0009bd8e6c
|
Update .htaccess
Delete a bugfix for PHP4, because the current version requires at least PHP 5.2.1. The case thus never occurs.
|
11 years ago |
|
Thomas Bruederli
|
3568c7c04b
|
Fix rewrite rule to actually prevent access to bin/ and SQL/ directories
|
12 years ago |
|
Raoul Bhatia
|
5422e6d5ae
|
prevent access to UPGRADING via .htaccess
|
12 years ago |
|
Thomas Bruederli
|
aff970b5d3
|
Replace some forgotten references to skins/default (#1488591)
|
12 years ago |
|
Raoul Bhatia
|
b332e799b4
|
improve .htaccess security rules:
1. also prevent access to .gitignore
2. make the second security rule work as expected
3. include README.md in security rules
|
12 years ago |
|
Antoine Catton
|
a93f39a8f2
|
Replace directory .svn/ by .git/ in security rules
|
12 years ago |
|
alecpl
|
57d15d5023
|
- Escape dot in regexp (#1488357)
|
13 years ago |
|
alecpl
|
5e8c7729fb
|
- Add ifModule statement for setting Options -Indexes in .htaccess file (#1488274)
|
13 years ago |
|
alecpl
|
4b1d5d6e38
|
Improve .htaccess rules to make it less easy to fingerprint roundcube version
by denying access to files and stoping directory indexes (#1484066)
|
13 years ago |
|
thomascube
|
29640bcfa9
|
Add (inactive) session.cookie_path line to .htaccess as suggested in #1486456
|
15 years ago |
|
alecpl
|
6d479a622b
|
- remove set_magic_quotes_runtime() call, use set_time_limit() with @ (#1486149)
|
15 years ago |
|
till
|
832890135c
|
* using php_flag to turn it off (instead of php_value)
|
15 years ago |
|
thomascube
|
4b20e28718
|
Don't set php_value error_log in .htaccess by default
|
15 years ago |
|
thomascube
|
49c71c7981
|
Remove access control from .htaccess
|
15 years ago |
|
thomascube
|
2f14293716
|
Use filemtime for cache busting + better etag for static files
|
15 years ago |
|
alecpl
|
80a36b53ad
|
- disable zlib.output_compression in default config
|
15 years ago |
|
alecpl
|
d51c93b43e
|
- get rid of some hardcoded action names and move decission about output compression to the user
|
15 years ago |
|
thomascube
|
d7f49d64d3
|
Speedup UI by using CSS sprites and etags/expires/deflate for static files
|
15 years ago |
|
alecpl
|
2d1a451c25
|
- suhosin.session.encrypt breaks Session handling (#1485846)
|
15 years ago |
|
till
|
429f7411a0
|
* removed, .sh scripts are fixed, not necessary for .inc
|
16 years ago |
|
thomascube
|
64c52c63ad
|
Deny access to .sh files
|
16 years ago |
|
alecpl
|
e86ff9459c
|
#1485571: mbstring.func_overload forbidden
|
16 years ago |
|
alecpl
|
34942eb104
|
#1485375, #1485491
|
16 years ago |
|
alecpl
|
e3f4275028
|
#1485375: added favicon.ico redirect
|
16 years ago |
|
alecpl
|
aaa6ace377
|
#1485460: session.gc_* moved to main .htaccess file
|
16 years ago |
|
alecpl
|
d4f264827a
|
#1485155: added zend.ze1_compatibility_mode check in installer and option disabled in .htaccess
|
16 years ago |
|
alecpl
|
36bee3f146
|
-removed content for mod_php4
|
16 years ago |
|
thomascube
|
04e87eefd8
|
Adapt changes to .htaccess and README
|
17 years ago |
|
svncommit
|
242675b0a4
|
make magic_quotes_gpc = 0
|
17 years ago |
|
till
|
342db9d08a
|
* check.php: add another check for zlib.output_compression 0
* .htaccess: forcing it off
|
17 years ago |
|
till
|
f094b0498b
|
* corrected a mistake I made on my last commit when i forced auto_start to "1", but of course it has to be "0"/off (thanks "the_glu@freenode")
|
17 years ago |