Debian Bug report logs - #319398
php4.conf: use Files directive to deny unintentional filenames

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stephen Gildea <gildea@stop.mail-abuse.org>

To: submit@bugs.debian.org

Subject: php4.conf: use Files directive to deny unintentional filenames

Date: Thu, 21 Jul 2005 11:54:30 -0700

Package: libapache-mod-php4
Version: 4:4.3.10-15
Tags: patch

The default Debian /etc/apache/conf.d/php4.conf should use a Files
directive to deny access to files that probably shouldn't have been
placed in the web tree to begin with.  

I recognize that with a properly-configured site this step would be
unnecessary, but I've seen too many PHP-based packages that install all
files under the web document root, whether they are intended to be
visible from the web or not.  This patch protects sites that are running
such packages.

The *.tpl pattern in the patch catches template files for phpBB, Smarty,
etc.

 < Stephen


*** php4-4.3.10/debian/libapache-mod-php4.conf	Thu Jul 21 00:12:37 2005
--- debian/libapache-mod-php4.conf	Thu Jul 21 00:21:36 2005
***************
*** 1,4 ****
--- 1,12 ----
  <IfModule mod_php4.c>
    AddType application/x-httpd-php .php .phtml .php3
    AddType application/x-httpd-php-source .phps
+ 
+   # Files with these names should not be installed under
+   # DocumentRoot, but just in case, deny access to them.
+   <Files ~ "\.ini$|\.inc$|\.tpl$">
+       Order allow,deny
+       Deny from all
+   </Files>
+ 
  </IfModule>
*** php4-4.3.10/debian/libapache2-mod-php4.conf	Thu Jul 21 00:12:37 2005
--- debian/libapache2-mod-php4.conf	Thu Jul 21 00:22:31 2005
***************
*** 1,4 ****
--- 1,12 ----
  <IfModule mod_php4.c>
    AddType application/x-httpd-php .php .phtml .php3
    AddType application/x-httpd-php-source .phps
+ 
+   # Files with these names should not be installed under
+   # DocumentRoot, but just in case, deny access to them.
+   <Files ~ "\.ini$|\.inc$|\.tpl$">
+       Order allow,deny
+       Deny from all
+   </Files>
+ 
  </IfModule>

Message #8 received at 319398-submitter@bugs.debian.org (full text, mbox, reply):

From: Ondrej Sury <ondrej@sury.org>

To: 319398-submitter@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: php4.conf: use Files directive to deny unintentional filenames

Date: Thu, 30 Nov 2006 08:56:54 +0100

[Message part 1 (text/plain, inline)]

package php4
tags 319398 +wontfix
severity 319398 wishlist
thank you

This hint should propably go to README.Debian or such file, but I don't
consider appropriate for us to make workaround for every braindead php
application around.

Ondrej.
-- 
Ondřej Surý <ondrej@sury.org>                         http://blog.rfc1925.org/

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 319398@bugs.debian.org (full text, mbox, reply):

From: Lucas Nussbaum <lucas@lucas-nussbaum.net>

To: 301824@bugs.debian.org, 330419@bugs.debian.org, 317577@bugs.debian.org, 321460@bugs.debian.org, 319398@bugs.debian.org, 419714@bugs.debian.org, control@bugs.debian.org, libapache2-mod-php5@packages.debian.org

Subject: Reassigning bugs from libapache-mod-php4 to libapache2-mod-php5

Date: Mon, 05 May 2008 10:19:16 +0200

reassign 301824 libapache2-mod-php5
reassign 330419 libapache2-mod-php5
reassign 317577 libapache2-mod-php5
reassign 321460 libapache2-mod-php5
reassign 319398 libapache2-mod-php5
reassign 419714 libapache2-mod-php5
thanks

The libapache-mod-php4 package has been removed from Debian testing, unstable and
experimental. I am reassigning its bugs to the libapache2-mod-php5 package. Please
have a look at them, and close them if they don't apply to
libapache2-mod-php5 anymore.

Don't hesitate to reply to this mail if you have any question.
-- 
Lucas

Message #26 received at 319398-done@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: 319398-done@bugs.debian.org

Subject: Re: Bug#319398: php4.conf: use Files directive to deny unintentional filenames

Date: Wed, 02 Jul 2014 14:11:30 +0200

As explained before we are not going to fix that. It's the
responsibility
of the application to either use sane extensions or prevent access.

No size fits all here.

O.
-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server

Send a report that this bug log contains spam.