319241 - Bugzilla.pm is freely accessible from the web

Status: RESOLVED FIXED

(Bugzilla :: Installation & Upgrading, defect)

Description

[Frédéric Buclin]

Bugzilla/*.pm files are protected. I see no reason to let ./Bugzilla.pm accessible from the web. You don't know the kind of customisations some admins may do, and being able to access source code increases the risk of attacks (especially if the file is incorrectly modified).

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

Comment 2

[Frédéric Buclin]

Attachment: patch, v1.1

Update existing .htaccess as well.

Comment 3

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 205099 [details] [diff] [review]
patch, v1.1

This works OK, but it's quite brittle.  For example, my .htaccess file contained the following:

# don't allow people to retrieve non-cgi executable files or our private data
<FilesMatch ^(.*\.pl|.*localconfig.*|runtests.sh)$>
  deny from all
</FilesMatch>
<FilesMatch ^(localconfig.js|localconfig.rdf)$>
  allow from all
</FilesMatch>

Had the two rules been reversed, .*\.pm would have been added to the rule that allows access from everywhere. r=myk, but we should do something better, like surrounding the content we generate so we only ever update that content and not something an installation has manually added.  We might also add a configuration option for whether or not to write this file (so installations that want different rules can have them).

Comment 4

[Dave Miller [:justdave]]

(In reply to comment #3)
> We might also add a
> configuration option for whether or not to write this file (so installations
> that want different rules can have them).

We already do this.  There's a variable for it in the localconfig file.

Comment 5

[Frédéric Buclin]

tip:

Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.456; previous revision: 1.455
done

2.20:

Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.412.2.14; previous revision: 1.412.2.13
done