myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-28 09:12:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

security: remove stray !install!! deploy folder, block .py files, move secrets out of webroot

Browse Source 
- Delete !install!!/ (schema.sql, migrations, fix_tjj.py) - unreferenced leftover
  deploy artifacts, fix_tjj.py was publicly downloadable (200) since the folder
  name did not match the existing /install/ block pattern
- .htaccess: add .py to blocked extensions, explicitly block the !install!!/ path
- config/config.php: replace with a require shim pointing to config-secrets.php
  outside the web root (Stripe/CyberMail keys no longer sit in a web-servable file)
This commit is contained in:
Myron Blair
2026-07-05 05:18:50 +00:00
parent a4ebf26a48
commit a0b8bf2a09
6 changed files with 4 additions and 707 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.htaccess
+3 -2
View File
@@ -8,9 +8,10 @@ RewriteEngine On
# includes/*.php, and .git/ were all still reachable live despite the
# RedirectMatch rules further down) — only mod_rewrite matching on REQUEST_URI
# is confirmed to actually work here. This must come before other rewrites.
RewriteCond %{REQUEST_URI} ^/(\.git|config/|includes/.*\.php|install/|db/)
RewriteCond %{REQUEST_URI} ^/(\.git|config/|includes/.*\.php|install/|!install!!/|db/)
RewriteRule .* - [F,L]
RewriteCond %{REQUEST_URI} \.sql$
RewriteCond %{REQUEST_URI} \.sql$ [OR]
RewriteCond %{REQUEST_URI} \.py$
RewriteRule .* - [F,L]
# Force HTTPS (uncomment in production)