Actions
Bug #22513
closed
Changelog, README, NEWS files should be blocked via htaccess
Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2010-04-26
Due date:
% Done:
0%
Estimated time:
TYPO3 Version:
4.4
PHP Version:
5.2
Tags:
Complexity:
Is Regression:
Sprint Focus:
Description
OTRS Ticket ID: 2010042610000013
Files like Changelog, README, NEWS.txt etc. that are publicly visible
allow easy scanning for vulnerable TYPO3 or extension versions.
So TYPO3's default .htaccess should deny access to these files by default.
(issue imported from #M14203)
Updated by Helmut Hummel over 13 years ago
We agreed, that this would not help much. It would still fairly easy be possible to track the TYPO3 and extension versions
Updated by Christian Weiske almost 10 years ago
I still think that it would help in making fingerprinting harder.
Actions