[#48076] - [6.2] Htaccess hardening to allowed files
- Ready to Commit
- Medium
- Build: 6.2-dev
- # 48076
- Diff
- brianteeman:htaccess
User tests: Successful: Unsuccessful:
Pull Request resolves # .
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
This pull request improves the default .htaccess security by restricting direct access to files in the images, media, and files directories.
Previously, the default htaccess.txt did not prevent direct access to uploaded executable files. While you should not be able to upload executable files to these folders a poorly configured extension may allow it, leaving sites potentially vulnerable if an attacker is able to upload a malicious script.
The new rules adopt a whitelist approach:
- Requests for a defined set of safe file types (images, documents, media files, archives and web assets) are permitted.
- Requests for any other file type within the
images,media, andfilesdirectories are denied with a403 Forbiddenresponse.
Compared to a blacklist of executable extensions, a whitelist provides stronger protection by denying unknown or unexpected file types by default.
The accompanying post-installation message has also been updated to explain the change and provide the rules that should be manually added to existing .htaccess files, as these files cannot be updated automatically.
The post installation message will be shown to upgrading users
Testing Instructions
Clean install of j62
Download the pre-built installation package from this PR and install
On installation there is NO post-installation message about the new htaccess
the new htaccess.txt is available in the root of the web site
Upgrade from 6.1 to 62
On an installation of J6.1 upgrade it to J6.2 using the upgrade package from this PR
On upgrade there is a NEW post-installation message about the new htaccess
the new htaccess.txt is available in the root of the web site
If accepted I will update https://guide.joomla.org/user-manual/configuration/configuration-the-htaccess-file
Link to documentations
Please select:
-
Documentation link for guide.joomla.org:
-
No documentation changes for guide.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_admin SQL Postgresql Language & Strings |
| Labels |
Added:
Language Change
PR-6.2-dev
|
||
| Title |
|
||||||
I agree with this addition (did the same for my own extension images folder).
Just a question? Can't we just force it with files added to the root of images, files and media?
Maybe adding as well the web.config version.
I agree with this addition (did the same for my own extension images folder).
Just a question? Can't we just force it with files added to the root of images, files and media?
Maybe adding as well the web.config version.
No you can't do that, at least not on an update
Great idea, thanks
Might it be worth including the tmp folder as well? Obviously, it needs to be possible to write PHP files into it, but they don’t need to be executable ‘from outside’. If I remember correctly, the JCE exploit created an x.php file inside tmp, which was then executed.
Re: web.config as I can't test that I won't be able to submit an update for that. As the web.config already has weaker settings than htaccess I would suggest that is considered in its own pr as there would be bigger changes needed there
Re: web.config as I can't test that I won't be able to submit an update for that. As the web.config already has weaker settings than htaccess I would suggest that is considered in its own pr as there would be bigger changes needed there
I was about to update my comment, as more easy for testing as well to be separated, but you were faster! ;-)
@coolcat-creations you can test, download is available now.
I have tested this item ✅ successfully on 7f9adab
Successfully tested in all 3 Folders and also with subfolders
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48076.
I have tested this item ✅ successfully on 7f9adab
Successfully tested in all 3 Folders and also with subfolders
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48076.
I have tested this item ✅ successfully on 7f9adab
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48076.
I have tested this item ✅ successfully on 7f9adab
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48076.
@coolcat-creations @rbuelund I assume you have tested with MySQL or MariaDB, but not with PostgreSQL, right?
| Labels |
Added:
Updates Requested
PBF
|
||
I tested with MariaDB
@coolcat-creations @rbuelund I assume you have tested with MySQL or MariaDB, but not with PostgreSQL, right?
I tested with MariaDB
@coolcat-creations @rbuelund Bonus question: Have you tested both "Clean install of j62" and "Upgrade from 6.1 to 62" scenarios, or only one of them?
@alikon Would be cool to get a test with PostgreSQL, too. Maybe you could find the time? If possible, test both scenarios "Clean install of j62" and "Upgrade from 6.1 to 62", but if you don't have much time, then at least the "Upgrade from 6.1 to 62". Thanks in advance.
@richard67 We tested only with mariaDB - upgrade from 6.1 til 6.2.
I know that @rbeulend tested an update
Yes we did.
@richard67 We tested only with mariaDB - upgrade from 6.1 til 6.2.
@rbuelund Good that you have tested the upgrade because that's the most critical thing.
The latest change in the update SQL for MySQL (and MariaDB) due to my review suggestion did not really change how it works, it just adapter to stricter syntax.
So I would say your 2 tests are still valid.
However, it would be good to have an update test with PostgreSQL, too, just to play safe.
Let's see if @alikon finds the time.
I know this doesnt count as a test as of course I tested my code first but this is a recording of Joomla 6.1 using postgres being updated to 6.2 with this PR
thorium_WowtjKKpo1.mp4
I know this doesnt count as a test as of course I tested my code first but this is a recording of Joomla 6.1 using postgres being updated to 6.2 with this PR
@brianteeman Before or after my review suggestions on the update SQL script was applied?
After. I just recorded it.
I will check tomorrow when I’m back to my desk.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48076.
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48076.
just a heads up - we don't use the words "white" and "black" - list see https://manual.joomla.org/docs/user-interface-text/words2watch/
| Title |
|
||||||
just a heads up - we don't use the words "white" and "black" - list see https://manual.joomla.org/docs/user-interface-text/words2watch/
my bad - and I was the one that wrote that
I've tested the htaccess rule and it works as expected. Not marking this as successfull test, because I didn't test the postinstall message