Author Topic: Create dummy index.html file in all CiviCRM directories (Read 7243 times)

sureddin · August 31, 2008, 01:53:58 pm

In Joomla, every directory has a dummy index.html file that prevents enumeration and display of files in a directory. It seems that CiviCRM does not do that.

While, I don't see an explicit security issue with the current CiviCRM setup, having the dummy index.html file in every CiviCRM directory/subdirectory seems to limit basic information exposure of files on the site, and more particularly if someone started modifying CiviCRM files, the new filenames would not be readily accessible as it is now.

Thanks
Paul

Donald Lobo · August 31, 2008, 03:08:35 pm

Quote from: sureddin on August 31, 2008, 01:53:58 pm

In Joomla, every directory has a dummy index.html file that prevents enumeration and display of files in a directory. It seems that CiviCRM does not do that.

In general, this should be done at the webserver level preferably (restrict directory access). I'm not sure its a good idea for an application to add index.html to all directories, especially considering the number of directories and external packages civicrm uses

lobo

sureddin · August 31, 2008, 03:37:20 pm

Thanks Donald:

I have modified the ".htaccess" file for my site to include:

Options -Indexes

Which takes care of the file enumeration, but I will need to test to make sure that no other components are affected.

Paul

speleo · September 01, 2008, 12:39:25 am

Hi Paul,

Can you let us know if this works for you.

ken · September 28, 2008, 01:26:31 am

Folks,

I've just placed a .htaccess file in the administrator/components/com_civicrm directory of my test server. All it contains is the line 'Options -Indexes'.

The functionality works, except for the Contact Search widget (no Ajax calls), and the CSS doesn't appear to work.

Ken

ken · September 28, 2008, 02:18:19 am

I note that all the other extensions in my Joomla! installation have a blank index.html in each subdirectory. It seems to be the standard.

I appreciate why lobo might not want to add an index.html to each directory (does Drupal have the same issue?). However it might be wise to add the following pseudo-code to the Joomla installer ...

Code: [Select]

Starting at /administrator/components/com_civicrm and repeating for each sub-directory
    If directory doesn't contain index.html or index.php
        Create an index.html file containing '<html><body></body></html>'
Repeat at /components/com_civicrm

Ken

CiviCRM Community Forums (archive)

News:

Author Topic: Create dummy index.html file in all CiviCRM directories (Read 7243 times)

sureddin

Create dummy index.html file in all CiviCRM directories

Donald Lobo

Re: Create dummy index.html file in all CiviCRM directories

sureddin

Re: Create dummy index.html file in all CiviCRM directories

speleo

Re: Create dummy index.html file in all CiviCRM directories

ken

Re: Create dummy index.html file in all CiviCRM directories

ken

Re: Create dummy index.html file in all CiviCRM directories