mirror of
https://github.com/myronblair/orbis-hosting-portal
synced 2026-07-27 12:42:52 -05:00
myron
8ad58278d0
The docRoot is the git working tree, so .git/ was directly downloadable over HTTPS (curl https://orbis.orbishosting.com/.git/config returned 200), exposing the origin remote URL with an embedded GitHub personal access token in plaintext. Added a .htaccess denying dotfiles/.git and a matching OpenLiteSpeed vhost context as defense in depth. The exposed token should be revoked/rotated on GitHub regardless of this fix.
10 lines
386 B
ApacheConf
10 lines
386 B
ApacheConf
# Block direct web access to the .git directory and other dotfiles.
|
|
# The .git folder lives inside public_html (docRoot) and was found to be
|
|
# directly downloadable over HTTPS (e.g. https://orbis.orbishosting.com/.git/config),
|
|
# which leaked a live GitHub personal access token embedded in the remote URL.
|
|
RedirectMatch 404 /\.git
|
|
|
|
<FilesMatch "^\.">
|
|
Require all denied
|
|
</FilesMatch>
|