You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2020/10/27 06:21:11 UTC

[Bug 64852] New: Leakage of .ht contents

https://bz.apache.org/bugzilla/show_bug.cgi?id=64852

            Bug ID: 64852
           Summary: Leakage of .ht contents
           Product: Apache httpd-2
           Version: 2.4.46
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_access_compat
          Assignee: bugs@httpd.apache.org
          Reporter: udagawa@trans-networks.net
  Target Milestone: ---

Locate the ".htaccess" file in httpd's public directory.

---- start .htaccess ----
satisfy any

order deny,allow
deny from all
allow from 192.168.1.0/24

authtype basic
authuserfile /var/www/html/.htpasswd
authgroupfile /dev/null
authname "authorization required"
require valid-user
--- end .htaccess ----

Usually, any user can not access ".htaccess/.htpasswd" file because of
configuration, but user can read ".ht" file contents from allowed network
(192.168.1.x). If access from outside of allowed network or authorized user.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 64852] Leakage of .ht contents

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64852

Rich Bowen <rb...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #1 from Rich Bowen <rb...@apache.org> ---
Thank you for your report. As part of an effort to clean up our issue tracker,
we are closing tickets that have seen no activity for more than 5 years. If
this issue is still relevant to a current version of Apache httpd (2.4.x or
trunk), please reopen this ticket or open a new one with updated information.
We appreciate your contribution to the project.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org