Add configuration to deny access to composer files, .git etc.

[lavita-it]

What type of report is this:

Q	A
Bug report?
Feature request?
Enhancement?	Y

Description:

When deploying as described a lot of config files would be public (composer.lock, composer.custom, composer.json, .git etc.). I think we would need an additional apache configuration file to deny access to those files.

If a bug:

Q	A
Mautic version	2.15.0
PHP version	7.2

Steps to reproduce:

1. Deploy to Elastic Beanstalk
2. Access http://your-domain.com/.git/config or /composer.json etc.

Log errors:

No errors

[virgilwashere]

This should achieve that for nginx

• server-configs-nginx.

nginx deny location blocks

    # Deny all attempts to access hidden files/folders such as .git, .htaccess, .htpasswd, .DS_Store (Mac), etc...
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny yaml, twig, markdown, ini file access
    location ~* /.+\.(markdown|md|twig|yaml|yml|ini)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny all grunt, package files
    location ~* (Gruntfile|package)\.(js|json|jsonc)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny all composer files
    location ~* composer\. {
        deny all;
        access_log off;
        log_not_found off;
    }

[rinaldipratama]

This should achieve that for nginx

• server-configs-nginx.

nginx deny location blocks

    # Deny all attempts to access hidden files/folders such as .git, .htaccess, .htpasswd, .DS_Store (Mac), etc...
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny yaml, twig, markdown, ini file access
    location ~* /.+\.(markdown|md|twig|yaml|yml|ini)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny all grunt, package files
    location ~* (Gruntfile|package)\.(js|json|jsonc)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny all composer files
    location ~* composer\. {
        deny all;
        access_log off;
        log_not_found off;
    }

Thank you so much! It worked 😀