57161 - file can contain a password, shouldn't be readable

Status: VERIFIED FIXED

(Bugzilla :: Bugzilla-General, defect, P3)

Description

[uamjet602]

This file contains the password for the bugs user in the database if there is
one. It shouldn't be possible to display this file using an URL.

The documentation should really mention that one should create a .htaccess file
saying that this file should not be displayed.

Comment 1

[Jacob Steenhagen]

Adding [e-mail] to CC as this is a documentation issue

Comment 2

[Matthew Barnson]

Tara, reassign this to me would you?
I'll get a fix in the Bugzilla Guide Pre3, see if permissions can be adjusted in checksetup.pl, and update the README.

Comment 3

[Jacob Steenhagen]

-> [e-mail]

Comment 4

[Dave Miller [:justdave]]

moving to real milestones...

Comment 5

[Matthew Barnson]

I don't agree that we should worry about documenting the creation of a .htaccess
file to control access -- a simple .htaccess file included with the Bugzilla
distribution would solve this nicely : )

But information regarding securing Bugzilla needs to be in the Guide.  I will
check an appropriate .htaccess file in as well as document appropriate controls
in the Guide too.

Comment 6

[Gervase Markham [:gerv]]

AIUI .htaccess only works on Apache. We still need to document this in case 
people use other web servers.

Gerv

Comment 7

[Matthew Barnson]

I have put the relevant information into the Bugzilla Guide now, instructing
to disallow access to $BUGZILLA_HOME/localconfig and $BUGZILLA_HOME/data/ except
for data/comments.  I should be checking the change in tonight or tomorrow
morning.  I mention that the .htaccess files are *not* effective for anything
other than Apache or NCSA; I am unsure of if iPlanet honors .htaccess controls.

I have placed the following .htaccess files in these locations in my local cvs
repository (I would appreciate your buyoff in a comment before I check them in,
I plan on checking in late tonight or early tomorrow morning)

$BUGZILLA_HOME/data/
--begin .htaccess
<Files comments>
allow from all
</Files>
deny from all
--end .htaccess

$BUGZILLA_HOME/shadow/
--begin .htaccess
deny from all
--end .htaccess

$BUGZILLA_HOME/
<Files localconfig>
deny from all
</Files>
allow from all

I am marking these bugs as *resolved fixed* since the fix remains simply to
check into CVS.  If you disagree with this assessment, feel free to reopen the
bug : )

Comment 8

[Matthew Barnson]

Allow me to caveat: *I* will be checking this into CVS tonight : )

Comment 9

[Matthew Tuck [:CodeMachine]]

This stuff should surely go into the README.

Comment 10

[Dave Miller [:justdave]]

In search of accurate queries....  (sorry for the spam)

Comment 11

[Gervase Markham [:gerv]]

REOPENing. No .htaccess as yet. :-) Please close bugs after checking in fixes.

Gerv

Comment 12

[Chris Yeh]

stuck a blurb in the readme. 

Comment 13

[Matthew Tuck [:CodeMachine]]

V.  This is documented adequately in the README and Bugzilla Guide.

Comment 14

[Dave Miller [:justdave]]

Moving closed bugs to Bugzilla product