Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent directory listing on apache servers #10931

Merged
merged 2 commits into from Dec 1, 2016
Merged

Conversation

mattab
Copy link
Member

@mattab mattab commented Dec 1, 2016

And when caches are deleted, force re-creation of security files

fixes #10506

@mattab mattab added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label Dec 1, 2016
@mattab mattab added this to the 3.0.0-b4 milestone Dec 1, 2016
@mattab mattab merged commit de80b3a into 3.x-dev Dec 1, 2016
@mattab mattab deleted the nodirlisting_apache branch December 1, 2016 09:07
@@ -30,6 +31,7 @@ public static function deleteAllCacheOnUpdate($pluginName = false)
TrackerCache::deleteTrackerCache();
PiwikCache::flushAll();
self::clearPhpCaches();
ServerFilesGenerator::createFilesForSecurity();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On my local server it takes like 2-3 minutes to execute this just FYI. Might slow down clearing caches. Might take a bit longer because I have also many files in node_modules but even without might take a while to execute

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, good find, I'll remove it again

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done in bd09596

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

path disclosure in http://demo3.piwik.org/libs/
2 participants