Expected Behavior

With .htaccess installed and respected which blocks any access to matomo/config, which can be verified by manually trying to access the directory or any contained file and running a curl locally and remotely, the Matomo system check should not throw a related "critical issues".

Current Behavior

https://domain.com/matomo/config/config.ini.php

We found that the above URLs are accessible via the browser, but they should NOT be. Allowing them to be accessed can pose a potential security risk since the contents can provide information about your server and potentially your users. Please restrict access to them.

We also found that Matomo's config directory is publicly accessible. While attackers can't read the config now, if your webserver stops executing PHP files for some reason, your MySQL credentials and other information will be available to anyone. Please check your webserver config and deny access to this directory.

Possible Solution

TBD, I'll have a look into the code.

Steps to Reproduce (for Bugs)

1. Upgrade to Matomo 4.3.0-rc2 (issue appeared with rc1, AFAIK)
2. Check Diagnostics > System Check

Context

Your Environment

• Matomo Version: 4.3.0-rc2
• PHP Version: 8.0.5
• Server Operating System: Debian Bullseye
• Additionally installed plugins:

  Plugins Activated:

  API, Actions, Annotations, BotTracker 2.01, BulkTracking, Contents, CoreAdminHome, CoreConsole, CoreHome, CorePluginsAdmin, CoreUpdater, CoreVisualizations, CustomJsTracker, DBStats, DarkTheme 1.1.6, Dashboard, DevicePlugins, DevicesDetection, Diagnostics, Goals, Heartbeat, ImageGraph, Insights, Installation, Intl, LanguagesManager, Live, LogViewer 4.0.1, Login, Marketplace, Monolog, Morpheus, Overlay, PagePerformance, PrivacyManager, Proxy, Referrers, Resolution, SEO, SegmentEditor, SitesManager, Transitions, UserLanguage, UsersManager, VisitFrequency, VisitTime, VisitorInterest, VisitsSummary, WebsiteMeasurable