Use temporary htaccesstest.txt for data dir security check#25014
Use temporary htaccesstest.txt for data dir security check#25014
Conversation
|
btw is |
|
Btw, the warning should show up in |
|
@nickvergessen hmm, in my case nothing showed up either that's why I added the The |
|
Okay, I used a datadir outside the server root, so the check is skipped. |
|
One question: because there are now many instances out which use .ocdata. |
|
@mmattel no. Using it for data dir access was only an addition, since we knew that file would always be there. |
|
See #22310 (comment) for more context. The issue report explains it better. |
|
So, do we agree on this approach ? Note that this will require a backport to 9.0 |
|
Fine to me 👍 |
|
stable9: #25045 |
|
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
Fixes #24987
Brings back the htaccesstest.txt file and uses that instead of ".ocdata" for the ajax htaccess check.
Also added cache buster for that file to avoid getting 304 when accessing the file.
I'm not too happy about the approach but it seems to work.
The reason I'm not happy:
isHtaccessWorkingfunction which is still used at setup time, but not touching it would result in duplicate codePlease review @nickvergessen @rullzer @RealRancor @icewind1991 @danimo