myron/parkerslingshotrentals
1
0
Fork 0
mirror of https://github.com/myronblair/parkerslingshotrentals synced 2026-07-27 16:42:32 -05:00
Code Issues Packages Projects Releases Wiki Activity

CRITICAL: block direct access to customer license/insurance uploads (was fully downloadable with no auth); fix double-booking race condition and unstable deposit-hold idempotency key

Browse Source
This commit is contained in:
Myron Blair
2026-07-06 07:53:11 +00:00
parent 3bf7fe7620
commit 671df18039
3 changed files with 51 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.htaccess
+7
View File
@@ -12,3 +12,10 @@ RewriteRule .* - [F,L]
# issue found and fixed on sibling sites this session.
RewriteCond %{REQUEST_URI} ^/\.git
RewriteRule .* - [F,L]
# uploads/ (customer license/insurance docs) must never be directly downloadable -
# same Order/Deny-doesn't-work-on-OpenLiteSpeed gotcha as .git above. Docs are
# served only through view-doc.php / admin/view-doc.php, which read by filesystem
# path via readfile() - blocking direct URL access here doesn't break that flow.
RewriteCond %{REQUEST_URI} ^/uploads/
RewriteRule .* - [F,L]