Commit Graph

56 Commits (f1483204c70bbfd0988414f9301568d6493c81c0)

Author SHA1 Message Date
Aleksander Machniak ded453cdc4 Fix .htaccess rewrite rules to not block .well-known URIs (#1490615)
Conflicts:

	.htaccess
	CHANGELOG
9 years ago
Aleksander Machniak 0b9b9f63b5 Enable FollowSymLinks option in .htaccess file which is required by rewrite rules (#1490255) 10 years ago
Raoul Bhatia fd0583a846 Explicitly deny access to newly created "Dockerfile" 10 years ago
Aleksander Machniak 681ba6fc3c Improve system security by using optional special URL with security token
Allows to define separate server/path for image/js/css files
Fix bugs where CSRF attacks were still possible on some requests
10 years ago
Aleksander Machniak 6b7e06620d Remove zend.ze1_compatibility_mode checks, it does not exist in PHP >= 5.3 10 years ago
Aleksander Machniak 93e12fa414 Support upload progress with session.upload_progress and PECL uploadprogress module (#1488702) 11 years ago
Aleksander Machniak 4c7a980aaa Convert tabs to spaces 11 years ago
Aleksander Machniak 0314bff278 Set register_globals=off in .htaccess file and add note to INSTALL 11 years ago
Aleksander Machniak 2dade15d83 Fix security rules in .htaccess preventing access to base URL without the ending slash (#1489477) 11 years ago
Aleksander Machniak 88934b6132 Keep all security rules in one place, support Apache 2.4 syntax 11 years ago
Raoul Bhatia cb3ea1443e Deny access to all files not containing a . (dot) to block access to different README, ChangeLog, etc. files of various skins and plugins.
Do not check case for default README/INSTALL/LICENE files.
11 years ago
Aleksander Machniak 1c51d16eb3 - Fix rewrite rule in .htaccess (#1489240) 12 years ago
Dennis1993 0009bd8e6c Update .htaccess
Delete a bugfix for PHP4, because the current version requires at least PHP 5.2.1. The case thus never occurs.
12 years ago
Thomas Bruederli 3568c7c04b Fix rewrite rule to actually prevent access to bin/ and SQL/ directories 12 years ago
Raoul Bhatia 5422e6d5ae prevent access to UPGRADING via .htaccess 12 years ago
Thomas Bruederli aff970b5d3 Replace some forgotten references to skins/default (#1488591) 13 years ago
Raoul Bhatia b332e799b4 improve .htaccess security rules:
1. also prevent access to .gitignore
2. make the second security rule work as expected
3. include README.md in security rules
13 years ago
Antoine Catton a93f39a8f2 Replace directory .svn/ by .git/ in security rules 13 years ago
alecpl 57d15d5023 - Escape dot in regexp (#1488357) 13 years ago
alecpl 5e8c7729fb - Add ifModule statement for setting Options -Indexes in .htaccess file (#1488274) 13 years ago
alecpl 4b1d5d6e38 Improve .htaccess rules to make it less easy to fingerprint roundcube version
by denying access to files and stoping directory indexes (#1484066)
14 years ago
thomascube 29640bcfa9 Add (inactive) session.cookie_path line to .htaccess as suggested in #1486456 15 years ago
alecpl 6d479a622b - remove set_magic_quotes_runtime() call, use set_time_limit() with @ (#1486149) 15 years ago
till 832890135c * using php_flag to turn it off (instead of php_value) 15 years ago
thomascube 4b20e28718 Don't set php_value error_log in .htaccess by default 15 years ago
thomascube 49c71c7981 Remove access control from .htaccess 16 years ago
thomascube 2f14293716 Use filemtime for cache busting + better etag for static files 16 years ago
alecpl 80a36b53ad - disable zlib.output_compression in default config 16 years ago
alecpl d51c93b43e - get rid of some hardcoded action names and move decission about output compression to the user 16 years ago
thomascube d7f49d64d3 Speedup UI by using CSS sprites and etags/expires/deflate for static files 16 years ago
alecpl 2d1a451c25 - suhosin.session.encrypt breaks Session handling (#1485846) 16 years ago
till 429f7411a0 * removed, .sh scripts are fixed, not necessary for .inc 16 years ago
thomascube 64c52c63ad Deny access to .sh files 16 years ago
alecpl e86ff9459c #1485571: mbstring.func_overload forbidden 16 years ago
alecpl 34942eb104 #1485375, #1485491 16 years ago
alecpl e3f4275028 #1485375: added favicon.ico redirect 16 years ago
alecpl aaa6ace377 #1485460: session.gc_* moved to main .htaccess file 16 years ago
alecpl d4f264827a #1485155: added zend.ze1_compatibility_mode check in installer and option disabled in .htaccess 17 years ago
alecpl 36bee3f146 -removed content for mod_php4 17 years ago
thomascube 04e87eefd8 Adapt changes to .htaccess and README 17 years ago
svncommit 242675b0a4 make magic_quotes_gpc = 0 17 years ago
till 342db9d08a * check.php: add another check for zlib.output_compression 0
* .htaccess: forcing it off
17 years ago
till f094b0498b * corrected a mistake I made on my last commit when i forced auto_start to "1", but of course it has to be "0"/off (thanks "the_glu@freenode") 17 years ago
till 5812134c2a * fixed #1484437
* also added it to check.php
17 years ago
thomascube fba1f5ab81 New class rcube_user + send message disposition notification 17 years ago
thomascube 5eee009671 Allow vars and PHP code in templates; improved page title; fixed #1484395 17 years ago
thomascube 0d1dd7c80c Fix message list selection + new pngbehavior + use strpos() instead of strstr() 18 years ago
thomascube ef9641e139 Use IfModule directive in .htaccess (closes #1484381) 18 years ago
svncommit 4b9efbb9f4 Fixes interface lock-up issues and minor bugs (richs) 18 years ago
thomascube 6d969b4d90 Documentation, code style and cleanup 18 years ago