diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2016-11-13 12:29:28 +0100 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2016-11-13 12:29:28 +0100 |
| commit | a2953cb10c6f9318868b8727dd9e86cf419ff66c (patch) | |
| tree | 626a57321d8f3cb91fe90045746bf336fb49a24a /phpBB/docs | |
| parent | 9c7e8c2dc5607a594f1e8d3a633dc686e8c002a7 (diff) | |
| parent | 44dd1ef9842c83f7ba4a37bf4a17489d5fe73991 (diff) | |
| download | forums-a2953cb10c6f9318868b8727dd9e86cf419ff66c.tar forums-a2953cb10c6f9318868b8727dd9e86cf419ff66c.tar.gz forums-a2953cb10c6f9318868b8727dd9e86cf419ff66c.tar.bz2 forums-a2953cb10c6f9318868b8727dd9e86cf419ff66c.tar.xz forums-a2953cb10c6f9318868b8727dd9e86cf419ff66c.zip | |
Merge branch 'ticket/security-181' into ticket/security-181-rhea
Diffstat (limited to 'phpBB/docs')
| -rw-r--r-- | phpBB/docs/INSTALL.html | 16 | ||||
| -rw-r--r-- | phpBB/docs/assets/css/stylesheet.css | 11 | ||||
| -rw-r--r-- | phpBB/docs/lighttpd.sample.conf | 2 | ||||
| -rw-r--r-- | phpBB/docs/nginx.sample.conf | 2 |
4 files changed, 27 insertions, 4 deletions
diff --git a/phpBB/docs/INSTALL.html b/phpBB/docs/INSTALL.html index 4837ad35e2..1468cf3f02 100644 --- a/phpBB/docs/INSTALL.html +++ b/phpBB/docs/INSTALL.html @@ -457,9 +457,21 @@ <a name="webserver_configuration"></a><h3>6.ii. Webserver configuration</h3> - <p>Depending on your web server, you may have to configure your server to deny web access to the <code>cache/</code>, <code>files/</code>, <code>store/</code> and other directories. This is to prevent users from accessing sensitive files.</p> + <p>Depending on your web server, you may have to configure your server to deny web access to the <code>cache/</code>, <code>files/</code>, <code>includes</code>, <code>phpbb</code>, <code>store/</code>, and <code>vendor</code> directories. This is to prevent users from accessing sensitive files.</p> - <p>For <strong>Apache</strong> there are <code>.htaccess</code> files already in place to do this for you. Similarly, for <strong>Windows</strong> based servers using <strong>IIS</strong> there are <code>web.config</code> files already in place to do this for you. For other webservers, you will have to adjust the configuration yourself. Sample files for <strong>nginx</strong> and <strong>lighttpd</strong> to help you get started may be found in <code>docs/</code> directory.</p> + <p> + For <strong>Apache</strong> there are <code>.htaccess</code> files already in place to do this for the most sensitive files and folders. We do however recommend to completely deny all access to the aforementioned folders and their respective subfolders in your Apache configuration.<br /> + On Apache 2.4, denying access to the <code>phpbb</code> folder in a phpBB instance located at <code>/var/www/html/</code> would work like this: + <pre> +<Directory /var/www/html/phpbb/*> + Require all denied +</Directory> +<Directory /var/www/html/phpbb> + Require all denied +</Directory></pre> + <br /> + <p>The same settings can be applied to the other mentioned directories by replacing <code>phpbb</code> by the respective directory name. Please pay attention to the difference in syntax between Apache version <a href="https://httpd.apache.org/docs/2.2/howto/access.html">2.2</a> and <a href="https://httpd.apache.org/docs/2.4/howto/access.html">2.4</a>.</p> + <p>For <strong>Windows</strong> based servers using <strong>IIS</strong> there are <code>web.config</code> files already in place to do this for you. For other webservers, you will have to adjust the configuration yourself. Sample files for <strong>nginx</strong> and <strong>lighttpd</strong> to help you get started may be found in <code>docs/</code> directory.</p> </div> diff --git a/phpBB/docs/assets/css/stylesheet.css b/phpBB/docs/assets/css/stylesheet.css index 192a6f9f79..c090ab7e07 100644 --- a/phpBB/docs/assets/css/stylesheet.css +++ b/phpBB/docs/assets/css/stylesheet.css @@ -115,6 +115,17 @@ code { padding: 0 4px; } +pre { + color: #006600; + font-weight: normal; + font-family: 'Courier New', monospace; + border-color: #D1D7DC; + border-width: 1px; + border-style: solid; + background-color: #FAFAFA; + padding: 0 4px +} + #wrap { padding: 0 20px; min-width: 650px; diff --git a/phpBB/docs/lighttpd.sample.conf b/phpBB/docs/lighttpd.sample.conf index 5b04122267..f5b509e002 100644 --- a/phpBB/docs/lighttpd.sample.conf +++ b/phpBB/docs/lighttpd.sample.conf @@ -37,7 +37,7 @@ $HTTP["host"] == "www.myforums.com" { accesslog.filename = "/var/log/lighttpd/access-www.myforums.com.log" # Deny access to internal phpbb files. - $HTTP["url"] =~ "^/(config\.php|common\.php|includes|cache|files|store|images/avatars/upload)" { + $HTTP["url"] =~ "^/(config\.php|common\.php|cache|files|images/avatars/upload|includes|phpbb|store|vendor)" { url.access-deny = ( "" ) } diff --git a/phpBB/docs/nginx.sample.conf b/phpBB/docs/nginx.sample.conf index c415720e9c..ce929b6e54 100644 --- a/phpBB/docs/nginx.sample.conf +++ b/phpBB/docs/nginx.sample.conf @@ -72,7 +72,7 @@ http { } # Deny access to internal phpbb files. - location ~ /(config\.php|common\.php|includes|cache|files|store|images/avatars/upload) { + location ~ /(config\.php|common\.php|cache|files|images/avatars/upload|includes|phpbb|store|vendor) { deny all; # deny was ignored before 0.8.40 for connections over IPv6. # Use internal directive to prohibit access on older versions. |