diff --git a/.htaccess b/.htaccess index a77c94a7..a8f5cbf7 100644 --- a/.htaccess +++ b/.htaccess @@ -1,11 +1,18 @@ # Generated file from class.acl.php - # Disable directory browsing - Options -Indexes - - Order deny,allow - Deny from all - - - Order Allow,Deny - Allow from all - \ No newline at end of file +# For detection of htaccess functionality +SetEnv OPENXE_HTACCESS on +# Disable directory browsing +Options -Indexes +# Set default page to index.php +DirectoryIndex "index.php" +# Deny general access +Order deny,allow + + Order Allow,Deny + Deny from all + +# Allow index.php + + Order Allow,Deny + Allow from all + \ No newline at end of file diff --git a/phpwf/plugins/class.acl.php b/phpwf/plugins/class.acl.php index 694ecad9..76286fc8 100644 --- a/phpwf/plugins/class.acl.php +++ b/phpwf/plugins/class.acl.php @@ -1214,40 +1214,44 @@ class Acl } - // HTACCESS SECURITY + // HTACCESS SECURITY // Check for correct .htaccess settings // true if ok, else error text protected function CheckHtaccess() : mixed { - $nominal = array( '# Generated file from class.acl.php - # Disable directory browsing - Options -Indexes - - Order deny,allow - Deny from all - - - Order Allow,Deny - Allow from all - ', - '# Generated file from class.acl.php - SetEnv OPENXE_HTACCESS on - - # Disable directory browsing - Options -Indexes - - Order deny,allow - Allow from all - - - Order Allow,Deny - Deny from all - - - - Order Allow,Deny - Allow from all - '); + $nominal = array('# Generated file from class.acl.php +# For detection of htaccess functionality +SetEnv OPENXE_HTACCESS on +# Disable directory browsing +Options -Indexes +# Set default page to index.php +DirectoryIndex "index.php" +# Deny general access +Order deny,allow + + Order Allow,Deny + Deny from all + +# Allow index.php + + Order Allow,Deny + Allow from all +', +'# Generated file from class.acl.php +# Disable directory browsing +Options -Indexes +# Deny access to all *.php +Order deny,allow +Allow from all + + Order Allow,Deny + Deny from all + +# Allow access to index.php + + Order Allow,Deny + Allow from all +'); $script_file_name = $_SERVER['SCRIPT_FILENAME']; $htaccess_path = array( @@ -1255,24 +1259,29 @@ class Acl dirname($script_file_name)."/.htaccess"); // www for ($count = 0;$count < 2;$count++) { - $htaccess = file_get_contents($htaccess_path[$count]); - if ($htacess === false) { - return("FATAL: ".$htaccess_path[$count]." nicht gefunden"); - } + $htaccess = file_get_contents($htaccess_path[$count]); + $result = strcmp(trim($htaccess[$count]),trim($nominal[$count])); - if ($result !== 0) { - $result = file_put_contents($htaccess_path[$count],$nominal[$count]); + + if (($result !== 0) || ($htaccess === false)) { + $result = file_put_contents($htaccess_path[$count],trim($nominal[$count])); if ($result === false) { - return("FATAL: ".$htaccess_path[$count]." fehlerhaft"); + + if ($htaccess === false) { + return("FATAL: ".$htaccess_path[$count]." nicht vorhanden und kann nicht korrigiert werden."); + } + return("FATAL: ".$htaccess_path[$count]." fehlerhaft und kann nicht korrigiert werden."); } } } + if (!isset($_SERVER['OPENXE_HTACCESS'])) { return("FATAL: htaccess nicht aktiv."); } + return(true); - // HTACCESS SECURITY END + // HTACCESS SECURITY END } } diff --git a/www/.htaccess b/www/.htaccess index 0e700325..cc24e244 100644 --- a/www/.htaccess +++ b/www/.htaccess @@ -1,18 +1,15 @@ -# Generated file from class.acl.php - SetEnv OPENXE_HTACCESS on - - # Disable directory browsing - Options -Indexes - - Order deny,allow - Allow from all - - - Order Allow,Deny - Deny from all - - - - Order Allow,Deny - Allow from all - \ No newline at end of file +# Generated file from class.acl.php +# Disable directory browsing +Options -Indexes +# Deny access to all *.php +Order deny,allow +Allow from all + + Order Allow,Deny + Deny from all + +# Allow access to index.php + + Order Allow,Deny + Allow from all + \ No newline at end of file