Details
-
Type:
Improvement
-
Status: Open
-
Priority:
Trivial
-
Resolution: Unresolved
-
Affects Version/s: 4.7.28
-
Fix Version/s: None
-
Component/s: Core CiviCRM
-
Labels:
-
Versioning Impact:Patch (backwards-compatible bug fixes)
-
Documentation Required?:Developer Doc
-
Funding Source:Contributed Code
-
Verified?:Yes
-
How it works currently:Files on newer Apache versions in secured folders (e.g. upload) can be accessed without proper authorization.
-
How it should work:Secured folders (e.g. upload) should be accessed with proper authorization, independent from the version of apache.
Description
The current .htaccess file is set up for Apache versions 2.2 and earlier. This causes security issues when the server/hosting company only supports newer versions, i.e. 2.4 and higher. In this case the old commands will not affect access.
