Beta Branch update tools/autoprotect.sh

update tools/autoprotect.sh

Continue reading...

123.09beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/123.09beta01
• Commit History: https://github.com/centminmod/centminmod/commits/123.09beta01

---

 

nginx by default doesn't list files in directory without index page and gives 403 errors. You'd need to know exact name of files in such a directory to access it.

tools/autoprotect.sh won't protect directories without a .htaccess file which contains 'Deny from all' text as .htaccess files are used for much more than one purpose i.e. for rewrites in apache

 

tools/autoprotect.sh in cases with .htaccess, deny all access to all files within directory and while nginx without index.html still allow access if you know the file name within the directory which doesn't have an index file so directly access the file instead

so if directory = /private

• /private/index.html with .htaccess (containing 'deny from all' text) converted to nginx deny all by tools/autoprotect.sh, will prevent all files under /private directory from being accessed i.e. /private/secretfile.html gives 403 status
• while /private directory without an index.html will give 403 on /private directory access but if you know /private/secretfile.html exists, you can directly access /private/secretfile.html gives 200 status

Purpose of tools/autoprotect.sh is outlined at Beta Branch - autoprotect.sh - apache .htaccess check & migration to nginx deny all. If you have a web app like wordpress, joomla, drupal etc, a lot of developers and plugin authors assume apache .htaccess and bundle .htaccess files with their scripts. But uploading those files to nginx based server will by default leave those intended directories with .htaccess deny from all settings wide open to the public if you don't have nginx deny all location context match rules setup. So tools/autoprotect.sh tries to automatically catch any such directories that folks miss when they setup their nginx vhost's nginx deny all location context match rules.

 

that would mess with alot of folks scripts though as that would mean every directory within a site gets deny all 403 permission denied as most directories do not have .htaccess files and autoprotect.sh script has no way to know which directory is private or public without a .htaccess file indicating such via 'deny from all' text within .htaccess file