Mercurial > repos > other > Puppet
changeset 476:b0531370e183
Avoid fully controllable rewrite prefix
Apache doesn't guarantee that rewrites are URLs or paths
within the prefix and will process them rather than error,
so close a fully controllable rewrite prefix:
https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1
| author | IBBoard <dev@ibboard.co.uk> |
|---|---|
| date | Sun, 11 Aug 2024 13:29:59 +0100 |
| parents | 1d39bde7f909 |
| children | 21f6add30502 |
| files | modules/website/files/conf.extra/no-index.conf |
| diffstat | 1 files changed, 1 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/modules/website/files/conf.extra/no-index.conf Sun Aug 11 11:18:31 2024 +0100 +++ b/modules/website/files/conf.extra/no-index.conf Sun Aug 11 13:29:59 2024 +0100 @@ -1,2 +1,2 @@ RewriteEngine On -RewriteRule ^(.*)/index.(php|htm(l?))$ $1/ [R=301,L] +RewriteRule ^(/.+)?/index.(php|htm(l?))$ $1/ [R=301,L]