Mercurial > repos > other > Puppet
diff modules/website/files/conf.extra/no-index.conf @ 476:b0531370e183
Avoid fully controllable rewrite prefix
Apache doesn't guarantee that rewrites are URLs or paths
within the prefix and will process them rather than error,
so close a fully controllable rewrite prefix:
https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1
| author | IBBoard <dev@ibboard.co.uk> |
|---|---|
| date | Sun, 11 Aug 2024 13:29:59 +0100 |
| parents | 956e484adc12 |
| children |
line wrap: on
line diff
--- a/modules/website/files/conf.extra/no-index.conf Sun Aug 11 11:18:31 2024 +0100 +++ b/modules/website/files/conf.extra/no-index.conf Sun Aug 11 13:29:59 2024 +0100 @@ -1,2 +1,2 @@ RewriteEngine On -RewriteRule ^(.*)/index.(php|htm(l?))$ $1/ [R=301,L] +RewriteRule ^(/.+)?/index.(php|htm(l?))$ $1/ [R=301,L]