myron/parkerslingshotrentals
1
0
Fork 0
mirror of https://github.com/myronblair/parkerslingshotrentals synced 2026-07-28 09:02:29 -05:00
Code Issues Packages Projects Releases Wiki Activity

CRITICAL: block direct access to customer license/insurance uploads (was fully downloadable with no auth); fix double-booking race condition and unstable deposit-hold idempotency key

Browse Source
This commit is contained in:
Myron Blair
2026-07-06 07:53:11 +00:00
parent 3bf7fe7620
commit 671df18039
3 changed files with 51 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
uploads/.htaccess
+5 -8
View File
@@ -1,8 +1,5 @@
# Block direct web access — documents served only through admin/view-doc.php
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
# Block direct web access - documents served only through view-doc.php / admin/view-doc.php.
# Require all denied / Order deny,allow do NOT work on this OpenLiteSpeed setup -
# only RewriteRule [F,L] actually blocks requests here (confirmed this session).
RewriteEngine On
RewriteRule .* - [F,L]