MAGETWO-40265: sensitive resources are web-accessible

hostep · Jul 16, 2015 · 5bc62a6 · 5bc62a6
1 parent 57a09f4
commit 5bc62a6
Show file tree

Hide file tree

Showing 8 changed files with 88 additions and 9 deletions.
diff --git a/.gitignore b/.gitignore
@@ -47,3 +47,4 @@ atlassian*
 /var/*
 !/var/.htaccess
 /vendor
+!/vendor/.htaccess
diff --git a/.htaccess b/.htaccess
@@ -170,13 +170,81 @@
 </IfModule>
 
 ###########################################
-## Deny access to release notes to prevent disclosure of the installed Magento version
-
-    <Files RELEASE_NOTES.txt>
-        Order allow,deny
-        Deny from all
+## Deny access to root files to hide sensitive application information
+    <Files composer.json>
+        order allow,deny
+        deny from all
     </Files>
-############################################
+    <Files composer.lock>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files .gitignore>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files .htaccess>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files .htaccess.sample>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files .php_cs>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files .travis.yml>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files CHANGELOG.md>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files CONTRIBUTING.md>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files CONTRIBUTOR_LICENSE_AGREEMENT.html>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files COPYING.txt>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files Gruntfile.js>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files LICENSE.txt>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files LICENSE_AFL.txt>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files nginx.conf.sample>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files package.json>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files php.ini.sample>
+        order allow,deny
+        deny from all
+    </Files>
+    <Files README.md>
+        order allow,deny
+        deny from all
+    </Files>
+
+################################
 ## If running in cluster environment, uncomment this
 ## http://developer.yahoo.com/performance/rules.html#etags
 

diff --git a/pub/errors/.htaccess b/pub/errors/.htaccess
@@ -2,6 +2,6 @@ Options None
 <IfModule mod_rewrite.c>
     RewriteEngine Off
 </IfModule>
-<FilesMatch "\.(xml|phtml)$">
-    Deny from all
-</FilesMatch>
+
+order allow,deny
+deny from all
diff --git a/setup/config/.htaccess b/setup/config/.htaccess
@@ -0,0 +1,2 @@
+order allow,deny
+deny from all
diff --git a/setup/performance-toolkit/.htaccess b/setup/performance-toolkit/.htaccess
@@ -0,0 +1,2 @@
+order allow,deny
+deny from all
diff --git a/setup/src/.htaccess b/setup/src/.htaccess
@@ -0,0 +1,2 @@
+order allow,deny
+deny from all
diff --git a/setup/view/.htaccess b/setup/view/.htaccess
@@ -0,0 +1,2 @@
+order allow,deny
+deny from all
diff --git a/vendor/.htaccess b/vendor/.htaccess
@@ -0,0 +1,2 @@
+Order allow,deny
+Deny from all
-Original file line number
+Diff line change
@@ Expand Up / @@ -47,3 +47,4 @@ atlassian* @@
     /var/*
     !/var/.htaccess
     /vendor
+    !/vendor/.htaccess