From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Tue, 22 Oct 2013 08:17:26 -0400 Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382) --- .htaccess | 12 ++++++++---- 1 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.htaccess b/.htaccess index 2bc9f95..345d26d 100644 --- a/.htaccess +++ b/.htaccess @@ -17,7 +17,7 @@ php_flag suhosin.session.encrypt Off #php_value session.cookie_path / -php_value session.auto_start 0 +php_flag session.auto_start Off php_value session.gc_maxlifetime 21600 php_value session.gc_divisor 500 php_value session.gc_probability 1 @@ -28,10 +28,11 @@ <IfModule mod_rewrite.c> RewriteEngine On -RewriteRule ^favicon.ico$ skins/default/images/favicon.ico +RewriteRule ^favicon\.ico$ skins/larry/images/favicon.ico # security rules -RewriteRule .svn/ - [F] -RewriteRule ^README|INSTALL|LICENSE|SQL|bin|CHANGELOG$ - [F] +RewriteRule \.git - [F] +RewriteRule ^/?(README(.md)?|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ - [F] +RewriteRule ^/?(SQL|bin) - [F] </IfModule> <IfModule mod_deflate.c> @@ -49,4 +50,7 @@ </IfModule> FileETag MTime Size + +<IfModule mod_autoindex.c> Options -Indexes +</ifModule> -- Gitblit v1.9.1