Author: PeterThoeny
Date: 2009-10-26 00:42:05 -0500 (Mon, 26 Oct 2009)
New Revision: 18190
Trac url: http://develop.twiki.org/trac/changeset/18190
Modified:
twiki/branches/TWikiRelease04x03/twiki_httpd_conf.txt
Log:
Item6246: Security: twiki root directory should not be exposed as html doc root
Modified: twiki/branches/TWikiRelease04x03/twiki_httpd_conf.txt
===================================================================
--- twiki/branches/TWikiRelease04x03/twiki_httpd_conf.txt 2009-10-26 05:40:48 UTC (rev 18189)
+++ twiki/branches/TWikiRelease04x03/twiki_httpd_conf.txt 2009-10-26 05:42:05 UTC (rev 18190)
@@ -5,21 +5,18 @@
# include "/home/httpd/twiki/twiki_httpd.conf"
# to the end of your main httpd.conf file.
#
-# See also http://twiki.org/cgi-bin/view/TWiki.ApacheConfigGenerator
+# See also http://twiki.org/cgi-bin/view/TWiki/ApacheConfigGenerator
# that helps you configure Apache
# The first parameter will be part of the URL to your installation e.g.
# http://example.com/twiki/bin/view/...
# The second parameter must point to the physical path on your disk. Be
# careful not to lose any trailing /'s.
-
#### Change the _second_ path to match your local installation
ScriptAlias /twiki/bin/ "/home/httpd/twiki/bin/"
-# This defines a url that points to the root of the twiki installation. It is
-# used to access files in the pub directory (attachments etc)
-# It must come _after_ the ScriptAlias.
-
+# This defines a url that points to the twiki pub directory, which contains
+# attachments and other files like CSS stylesheets and icons.
#### Change the path to match your local installation
Alias /twiki/ "/home/httpd/twiki/"
@@ -61,7 +58,7 @@
# Password file for TWiki users
AuthUserFile /home/httpd/twiki/data/.htpasswd
- AuthName 'Enter your WikiName: (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
+ AuthName 'Enter your WikiName: (First name and last name, no space, no dots, capitalized, e.g. JohnSmith)'
AuthType Basic
# File to return on access control error (e.g. wrong password)
@@ -131,31 +128,3 @@
# This line will redefine the mime type for the most common types of scripts
AddType text/plain .shtml .php .php3 .phtml .phtm .pl .py .cgi
</Directory>
-
-# Security note: All other directories should be set so
-# that they are *not* visible as URLs, so we set them as =deny from all=.
-
-#### Change the paths to match your local installation
-<Directory "/home/httpd/twiki/data">
- deny from all
-</Directory>
-
-<Directory "/home/httpd/twiki/templates">
- deny from all
-</Directory>
-
-<Directory "/home/httpd/twiki/lib">
- deny from all
-</Directory>
-
-<Directory "/home/httpd/twiki/tools">
- deny from all
-</Directory>
-
-<Directory "/home/httpd/twiki/locale">
- deny from all
-</Directory>
-
-<Directory "/home/httpd/twiki/working">
- deny from all
-</Directory>
|