When the top-level directory section for / was added for the sake

of performance and to allow automount symlinks to be followed, we
mistakenly opened access to the entire directory system by default.
I noticed this because all of the /~user directories are available
by default without any restrictions, which is a bad idea for anything
other than one server within a department of shared users.  However,
it also makes it easier to serve files anywhere on disk by mistake,
and makes other URI-handling bugs more severe than they would be
otherwise.  Therefore, this patch reinstates access control to deny
access to all files other than under DocumentRoot, icons, and manual,
until additional directory/locations are explicitly allowed by the admin.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100593 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/conf/httpd-std.conf.in b/docs/conf/httpd-std.conf.in
index 8dd7534e5feece7f3a5d1b17fbf5a4240adc5956..2d00028bc2cfaff60d7968b59afb96704dae586d 100644 (file)
--- a/docs/conf/httpd-std.conf.in
+++ b/docs/conf/httpd-std.conf.in
@@ -317,6 +317,8 @@ DocumentRoot "@exp_htdocsdir@"
 <Directory />
     Options FollowSymLinks
     AllowOverride None
+    Order deny,allow
+    Deny from all
 </Directory>
 
 #
@@ -362,7 +364,8 @@ DocumentRoot "@exp_htdocsdir@"
 
 #
 # UserDir: The name of the directory that is appended onto a user's home
-# directory if a ~user request is received.
+# directory if a ~user request is received.  Note that you must also set
+# the default access control for these directories, as in the example below.
 #
 <IfModule mod_userdir.c>
     UserDir public_html

diff --git a/docs/conf/httpd-win.conf b/docs/conf/httpd-win.conf
index 872326255cb80b16f15de7e4e72e97bc23d95e07..ffc29c5ca38e647a7ef13b72ac4a27df6fb72dd4 100644 (file)
--- a/docs/conf/httpd-win.conf
+++ b/docs/conf/httpd-win.conf
@@ -244,6 +244,8 @@ DocumentRoot "@@ServerRoot@@/htdocs"
 <Directory />
     Options FollowSymLinks
     AllowOverride None
+    Order deny,allow
+    Deny from all
 </Directory>
 
 #
@@ -291,7 +293,8 @@ DocumentRoot "@@ServerRoot@@/htdocs"
 # UserDir: The name of the directory that is appended onto a user's home
 # directory if a ~user request is received.  Be especially careful to use
 # proper, forward slashes here.  On Windows NT, "Personal/My Website"
-# is a more appropriate choice.
+# is a more appropriate choice.  Note that you must also set the default
+# access control for these directories, as in the example below.
 #
 UserDir "My Documents/My Website"