IP.Board IPB v4.1.x Files

Thankyou, done quite a lot of reading now, more to do me thinks.

I think Centminmod is rather good, fantastic !

---

 

You are probably better of by removing this line and adding:

Code:

location ~^(/applications/*/interface/).*(\.php)$ {
  allow all;
}

instead as outlined in: https://community.centminmod.com/posts/22535/

Basically all files that need to be accessed directly are in the apps interface folder.

 

Seems like it matches the deny as it's more specific?
Anyways, instead of writing an location block for each app you can group them like this:

Code:

location ~^(/forum/applications/(blog|calendar|chat|cms|core|downloads|forums|gallery|nexus)/interface/).*(\.php)$ {
  allow all;
  include /usr/local/nginx/conf/php.conf;
}

location ~^(/forum/applications/(blog|calendar|chat|cms|core|downloads|forums|gallery|nexus)/).*(\.php)$ {
  deny all;
}

 

The only directories that need to be disallowed are ./datestore, ./uploads and plugins.
I don't know of any file that needs to be directly accessed in the ./system folder aswell but there might be.
Most files have this little code in the beginning

Code:

/* To prevent PHP errors (extending class does not exist) revealing path */
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
    header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
    exit;
}

To prevent php errors from displaying full path so it is not really necessary to lock down the applications folder but you can do it.
However if someone, somehow manages to upload a php to an applications folder then you'd probably want this file to not be executable directly.
The more it's locked down, the more security you have

 

The one posted here: https://community.centminmod.com/posts/26825/ should work fine, I have tested it to make sure this time.

 

Yup, you'd need to add them manually.
For some reasons the wildcard way doesn't work. I've alot of work to do so no time to figure this out atm.

 

@Jimmy good stuff, thanks for doing this!

You still keeping this updated? Gist hasn't been touched since mid February, so just curious.

 

@Jimmy Running this on the latest centminmod beta stack with IPB 4.1.13.3 - All good and works sweet, upgraded curl, added SSL cert and Running HSTS now.

All working really well.