From eff277a8726d714979490126d42047cf4b438cb2 Mon Sep 17 00:00:00 2001 From: MichaIng Date: Sat, 25 Jul 2020 13:26:58 +0200 Subject: [PATCH] [ticket/16556] Remove purposeless from .htaccess MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wrapping access permissions into  at best has zero effect and implies unnecessary code and parsing for the web server. At least it does not block access to files only, but still denies auto indexing and access to sub directories effectively as well. But removing this directive is still the cleaner and safer way to deny access to any kind of resource that is provided within the directory in question. To deny access to migration data, a single .htaccess file can be used. This reduces the effort for future changes and it is not required anymore to create new .htaccess files for every new migration directory. Additionally this corrects the fact the "Require" is part of "mod_authz_core", not "mod_authz_host". PHPBB3-16556 Signed-off-by: MichaIng --- phpBB/cache/.htaccess | 22 ++++--------- phpBB/config/.htaccess | 24 +++++--------- phpBB/files/.htaccess | 24 +++++--------- phpBB/images/avatars/upload/.htaccess | 24 +++++--------- phpBB/includes/.htaccess | 24 +++++--------- .../db/migration/data/{v30x => }/.htaccess | 22 ++++--------- phpBB/phpbb/db/migration/data/v310/.htaccess | 33 ------------------- phpBB/phpbb/db/migration/data/v31x/.htaccess | 33 ------------------- phpBB/phpbb/db/migration/data/v320/.htaccess | 33 ------------------- phpBB/phpbb/db/migration/data/v32x/.htaccess | 33 ------------------- phpBB/phpbb/db/migration/data/v330/.htaccess | 33 ------------------- phpBB/phpbb/db/migration/data/v33x/.htaccess | 33 ------------------- phpBB/store/.htaccess | 24 +++++--------- 13 files changed, 54 insertions(+), 308 deletions(-) rename phpBB/phpbb/db/migration/data/{v30x => }/.htaccess (76%) delete mode 100644 phpBB/phpbb/db/migration/data/v310/.htaccess delete mode 100644 phpBB/phpbb/db/migration/data/v31x/.htaccess delete mode 100644 phpBB/phpbb/db/migration/data/v320/.htaccess delete mode 100644 phpBB/phpbb/db/migration/data/v32x/.htaccess delete mode 100644 phpBB/phpbb/db/migration/data/v330/.htaccess delete mode 100644 phpBB/phpbb/db/migration/data/v33x/.htaccess diff --git a/phpBB/cache/.htaccess b/phpBB/cache/.htaccess index 44242b5418..92e78ba1a7 100644 --- a/phpBB/cache/.htaccess +++ b/phpBB/cache/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied diff --git a/phpBB/config/.htaccess b/phpBB/config/.htaccess index 163ddd802f..92e78ba1a7 100644 --- a/phpBB/config/.htaccess +++ b/phpBB/config/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied - \ No newline at end of file + diff --git a/phpBB/files/.htaccess b/phpBB/files/.htaccess index 163ddd802f..92e78ba1a7 100644 --- a/phpBB/files/.htaccess +++ b/phpBB/files/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied - \ No newline at end of file + diff --git a/phpBB/images/avatars/upload/.htaccess b/phpBB/images/avatars/upload/.htaccess index 163ddd802f..92e78ba1a7 100644 --- a/phpBB/images/avatars/upload/.htaccess +++ b/phpBB/images/avatars/upload/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied - \ No newline at end of file + diff --git a/phpBB/includes/.htaccess b/phpBB/includes/.htaccess index 163ddd802f..92e78ba1a7 100644 --- a/phpBB/includes/.htaccess +++ b/phpBB/includes/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied - \ No newline at end of file + diff --git a/phpBB/phpbb/db/migration/data/v30x/.htaccess b/phpBB/phpbb/db/migration/data/.htaccess similarity index 76% rename from phpBB/phpbb/db/migration/data/v30x/.htaccess rename to phpBB/phpbb/db/migration/data/.htaccess index 44242b5418..92e78ba1a7 100644 --- a/phpBB/phpbb/db/migration/data/v30x/.htaccess +++ b/phpBB/phpbb/db/migration/data/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied diff --git a/phpBB/phpbb/db/migration/data/v310/.htaccess b/phpBB/phpbb/db/migration/data/v310/.htaccess deleted file mode 100644 index 44242b5418..0000000000 --- a/phpBB/phpbb/db/migration/data/v310/.htaccess +++ /dev/null @@ -1,33 +0,0 @@ -# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from -# module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. -# We could just conditionally provide both versions, but unfortunately Apache -# does not explicitly tell us its version if the module mod_version is not -# available. In this case, we check for the availability of module -# mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - - - Order Allow,Deny - Deny from All - - - = 2.4> - - Require all denied - - - - - - - Order Allow,Deny - Deny from All - - - - - Require all denied - - - diff --git a/phpBB/phpbb/db/migration/data/v31x/.htaccess b/phpBB/phpbb/db/migration/data/v31x/.htaccess deleted file mode 100644 index 44242b5418..0000000000 --- a/phpBB/phpbb/db/migration/data/v31x/.htaccess +++ /dev/null @@ -1,33 +0,0 @@ -# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from -# module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. -# We could just conditionally provide both versions, but unfortunately Apache -# does not explicitly tell us its version if the module mod_version is not -# available. In this case, we check for the availability of module -# mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - - - Order Allow,Deny - Deny from All - - - = 2.4> - - Require all denied - - - - - - - Order Allow,Deny - Deny from All - - - - - Require all denied - - - diff --git a/phpBB/phpbb/db/migration/data/v320/.htaccess b/phpBB/phpbb/db/migration/data/v320/.htaccess deleted file mode 100644 index 44242b5418..0000000000 --- a/phpBB/phpbb/db/migration/data/v320/.htaccess +++ /dev/null @@ -1,33 +0,0 @@ -# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from -# module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. -# We could just conditionally provide both versions, but unfortunately Apache -# does not explicitly tell us its version if the module mod_version is not -# available. In this case, we check for the availability of module -# mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - - - Order Allow,Deny - Deny from All - - - = 2.4> - - Require all denied - - - - - - - Order Allow,Deny - Deny from All - - - - - Require all denied - - - diff --git a/phpBB/phpbb/db/migration/data/v32x/.htaccess b/phpBB/phpbb/db/migration/data/v32x/.htaccess deleted file mode 100644 index 44242b5418..0000000000 --- a/phpBB/phpbb/db/migration/data/v32x/.htaccess +++ /dev/null @@ -1,33 +0,0 @@ -# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from -# module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. -# We could just conditionally provide both versions, but unfortunately Apache -# does not explicitly tell us its version if the module mod_version is not -# available. In this case, we check for the availability of module -# mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - - - Order Allow,Deny - Deny from All - - - = 2.4> - - Require all denied - - - - - - - Order Allow,Deny - Deny from All - - - - - Require all denied - - - diff --git a/phpBB/phpbb/db/migration/data/v330/.htaccess b/phpBB/phpbb/db/migration/data/v330/.htaccess deleted file mode 100644 index 44242b5418..0000000000 --- a/phpBB/phpbb/db/migration/data/v330/.htaccess +++ /dev/null @@ -1,33 +0,0 @@ -# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from -# module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. -# We could just conditionally provide both versions, but unfortunately Apache -# does not explicitly tell us its version if the module mod_version is not -# available. In this case, we check for the availability of module -# mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - - - Order Allow,Deny - Deny from All - - - = 2.4> - - Require all denied - - - - - - - Order Allow,Deny - Deny from All - - - - - Require all denied - - - diff --git a/phpBB/phpbb/db/migration/data/v33x/.htaccess b/phpBB/phpbb/db/migration/data/v33x/.htaccess deleted file mode 100644 index 44242b5418..0000000000 --- a/phpBB/phpbb/db/migration/data/v33x/.htaccess +++ /dev/null @@ -1,33 +0,0 @@ -# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from -# module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. -# We could just conditionally provide both versions, but unfortunately Apache -# does not explicitly tell us its version if the module mod_version is not -# available. In this case, we check for the availability of module -# mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - - - Order Allow,Deny - Deny from All - - - = 2.4> - - Require all denied - - - - - - - Order Allow,Deny - Deny from All - - - - - Require all denied - - - diff --git a/phpBB/store/.htaccess b/phpBB/store/.htaccess index 163ddd802f..92e78ba1a7 100644 --- a/phpBB/store/.htaccess +++ b/phpBB/store/.htaccess @@ -1,33 +1,25 @@ # With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from # module mod_authz_host to a new module called mod_access_compat (which may be -# disabled) and a new "Require" syntax has been introduced to mod_authz_host. +# disabled) and a new "Require" syntax has been introduced to mod_authz_core. # We could just conditionally provide both versions, but unfortunately Apache # does not explicitly tell us its version if the module mod_version is not # available. In this case, we check for the availability of module # mod_authz_core (which should be on 2.4 or higher only) as a best guess. - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All = 2.4> - - Require all denied - + Require all denied - - Order Allow,Deny - Deny from All - + Order Allow,Deny + Deny from All - - Require all denied - + Require all denied - \ No newline at end of file +