Skip to content

Commit 3c424e1

Browse files
author
Dale Sikkema
committed
Merge branch 'MAGETWO-40265-exposed-resources' into develop
2 parents b4128b2 + d18f569 commit 3c424e1

File tree

10 files changed

+194
-34
lines changed

10 files changed

+194
-34
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -47,3 +47,4 @@ atlassian*
4747
/var/*
4848
!/var/.htaccess
4949
/vendor
50+
!/vendor/.htaccess

‎.htaccess

+75-5
Original file line numberDiff line numberDiff line change
@@ -171,13 +171,83 @@
171171
</IfModule>
172172

173173
###########################################
174-
## Deny access to release notes to prevent disclosure of the installed Magento version
174+
## Deny access to root files to hide sensitive application information
175+
RedirectMatch 404 /\.git
175176

176-
<Files RELEASE_NOTES.txt>
177-
Order allow,deny
178-
Deny from all
177+
<Files composer.json>
178+
order allow,deny
179+
deny from all
179180
</Files>
180-
############################################
181+
<Files composer.lock>
182+
order allow,deny
183+
deny from all
184+
</Files>
185+
<Files .gitignore>
186+
order allow,deny
187+
deny from all
188+
</Files>
189+
<Files .htaccess>
190+
order allow,deny
191+
deny from all
192+
</Files>
193+
<Files .htaccess.sample>
194+
order allow,deny
195+
deny from all
196+
</Files>
197+
<Files .php_cs>
198+
order allow,deny
199+
deny from all
200+
</Files>
201+
<Files .travis.yml>
202+
order allow,deny
203+
deny from all
204+
</Files>
205+
<Files CHANGELOG.md>
206+
order allow,deny
207+
deny from all
208+
</Files>
209+
<Files CONTRIBUTING.md>
210+
order allow,deny
211+
deny from all
212+
</Files>
213+
<Files CONTRIBUTOR_LICENSE_AGREEMENT.html>
214+
order allow,deny
215+
deny from all
216+
</Files>
217+
<Files COPYING.txt>
218+
order allow,deny
219+
deny from all
220+
</Files>
221+
<Files Gruntfile.js>
222+
order allow,deny
223+
deny from all
224+
</Files>
225+
<Files LICENSE.txt>
226+
order allow,deny
227+
deny from all
228+
</Files>
229+
<Files LICENSE_AFL.txt>
230+
order allow,deny
231+
deny from all
232+
</Files>
233+
<Files nginx.conf.sample>
234+
order allow,deny
235+
deny from all
236+
</Files>
237+
<Files package.json>
238+
order allow,deny
239+
deny from all
240+
</Files>
241+
<Files php.ini.sample>
242+
order allow,deny
243+
deny from all
244+
</Files>
245+
<Files README.md>
246+
order allow,deny
247+
deny from all
248+
</Files>
249+
250+
################################
181251
## If running in cluster environment, uncomment this
182252
## http://developer.yahoo.com/performance/rules.html#etags
183253

‎.htaccess.sample

+79-16
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
############################################
3737
## adjust memory limit
3838

39-
php_value memory_limit 256M
39+
php_value memory_limit 768M
4040
php_value max_execution_time 18000
4141

4242
############################################
@@ -65,13 +65,6 @@
6565
SecFilterScanPOST Off
6666
</IfModule>
6767

68-
<IfModule mod_headers.c>
69-
############################################
70-
## prevent clickjacking
71-
72-
Header set X-Frame-Options SAMEORIGIN
73-
</IfModule>
74-
7568
<IfModule mod_deflate.c>
7669

7770
############################################
@@ -136,9 +129,11 @@
136129
RewriteRule .* - [L,R=405]
137130

138131
############################################
139-
## always send 404 on missing files in these folders
132+
## redirect for mobile user agents
140133

141-
RewriteCond %{REQUEST_URI} !^/pub/(media|js)/
134+
#RewriteCond %{REQUEST_URI} !^/mobiledirectoryhere/.*$
135+
#RewriteCond %{HTTP_USER_AGENT} "android|blackberry|ipad|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile" [NC]
136+
#RewriteRule ^(.*)$ /mobiledirectoryhere/ [L,R=302]
142137

143138
############################################
144139
## never rewrite for existing files, directories and links
@@ -175,16 +170,84 @@
175170
</IfModule>
176171

177172
###########################################
178-
## Deny access to release notes to prevent disclosure of the installed Magento version
173+
## Deny access to root files to hide sensitive application information
174+
RedirectMatch 404 /\.git
179175

180-
<Files RELEASE_NOTES.txt>
181-
Order allow,deny
182-
Deny from all
176+
<Files composer.json>
177+
order allow,deny
178+
deny from all
179+
</Files>
180+
<Files composer.lock>
181+
order allow,deny
182+
deny from all
183+
</Files>
184+
<Files .gitignore>
185+
order allow,deny
186+
deny from all
187+
</Files>
188+
<Files .htaccess>
189+
order allow,deny
190+
deny from all
191+
</Files>
192+
<Files .htaccess.sample>
193+
order allow,deny
194+
deny from all
195+
</Files>
196+
<Files .php_cs>
197+
order allow,deny
198+
deny from all
199+
</Files>
200+
<Files .travis.yml>
201+
order allow,deny
202+
deny from all
203+
</Files>
204+
<Files CHANGELOG.md>
205+
order allow,deny
206+
deny from all
207+
</Files>
208+
<Files CONTRIBUTING.md>
209+
order allow,deny
210+
deny from all
211+
</Files>
212+
<Files CONTRIBUTOR_LICENSE_AGREEMENT.html>
213+
order allow,deny
214+
deny from all
215+
</Files>
216+
<Files COPYING.txt>
217+
order allow,deny
218+
deny from all
219+
</Files>
220+
<Files Gruntfile.js>
221+
order allow,deny
222+
deny from all
223+
</Files>
224+
<Files LICENSE.txt>
225+
order allow,deny
226+
deny from all
227+
</Files>
228+
<Files LICENSE_AFL.txt>
229+
order allow,deny
230+
deny from all
231+
</Files>
232+
<Files nginx.conf.sample>
233+
order allow,deny
234+
deny from all
235+
</Files>
236+
<Files package.json>
237+
order allow,deny
238+
deny from all
239+
</Files>
240+
<Files php.ini.sample>
241+
order allow,deny
242+
deny from all
243+
</Files>
244+
<Files README.md>
245+
order allow,deny
246+
deny from all
183247
</Files>
184248

185-
############################################
249+
################################
186250
## If running in cluster environment, uncomment this
187251
## http://developer.yahoo.com/performance/rules.html#etags
188252

189253
#FileETag none
190-

‎nginx.conf.sample

+29-10
Original file line numberDiff line numberDiff line change
@@ -26,20 +26,42 @@ charset off;
2626

2727
location /setup {
2828
root $MAGE_ROOT;
29-
3029
location ~ ^/setup/index.php {
3130
fastcgi_pass fastcgi_backend;
3231
fastcgi_index index.php;
3332
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
3433
include fastcgi_params;
3534
}
35+
36+
location ~ /setup/(?!pub/). {
37+
deny all;
38+
}
39+
}
40+
41+
location /update {
42+
root $MAGE_ROOT;
43+
44+
location ~ /update/index.php {
45+
fastcgi_pass fastcgi_backend;
46+
fastcgi_index index.php;
47+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
48+
include fastcgi_params;
49+
}
50+
51+
# deny everything but index.php
52+
location ~ /update/(?!pub/). {
53+
deny all;
54+
}
3655
}
3756

3857
location / {
3958
try_files $uri $uri/ /index.php?$args;
4059
}
4160

4261
location /pub {
62+
location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
63+
deny all;
64+
}
4365
alias $MAGE_ROOT/pub;
4466
}
4567

@@ -70,6 +92,11 @@ location /static/ {
7092

7193
location /media/ {
7294
try_files $uri $uri/ /get.php?$args;
95+
96+
location ~ ^/media/theme_customization/.*\.xml {
97+
deny all;
98+
}
99+
73100
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
74101
add_header Cache-Control "public";
75102
expires +1y;
@@ -90,15 +117,7 @@ location /media/downloadable/ {
90117
deny all;
91118
}
92119

93-
location ~ /media/theme_customization/.*\.xml$ {
94-
deny all;
95-
}
96-
97-
location /errors/ {
98-
try_files $uri =404;
99-
}
100-
101-
location ~ ^/errors/.*\.(xml|phtml)$ {
120+
location /media/import/ {
102121
deny all;
103122
}
104123

‎pub/errors/.htaccess

-3
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,3 @@ Options None
22
<IfModule mod_rewrite.c>
33
RewriteEngine Off
44
</IfModule>
5-
<FilesMatch "\.(xml|phtml)$">
6-
Deny from all
7-
</FilesMatch>

‎setup/config/.htaccess

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
order allow,deny
2+
deny from all

‎setup/performance-toolkit/.htaccess

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
order allow,deny
2+
deny from all

‎setup/src/.htaccess

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
order allow,deny
2+
deny from all

‎setup/view/.htaccess

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
order allow,deny
2+
deny from all

‎vendor/.htaccess

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Order allow,deny
2+
Deny from all

0 commit comments

Comments
 (0)