572154 - Lock Down Server Configuration To Prevent Unnecessary Public Access to Files

Status: RESOLVED WONTFIX

(Websites Graveyard :: drumbeat.org, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

The drumbeat web server is providing access to files that do not need to be publicly accessible. For example:

http://www.drumbeat.org/patches/back_port-114774.patch
https://www.drumbeat.org/MAINTAINERS.txt
https://www.drumbeat.org/update.php
https://www.drumbeat.org/install.php
https://www.drumbeat.org/cron.php


Recommended Remediation

Remove any files that are no longer needed or restrict access to only authorized parties. Files such as update.php, install.php, and cron.php should be moved into the admin folder so access is restricted to only admin accounts.

Comment 1

[Paul Osman [:paulosman]]

Drupal based version drumbeat.org has been retired. This is not an issue on the current version. Static files served on the new site must be in the 'media' directory.