Kirby's default .htaccess file includes a set of rewrite rules for Apache, which should block access to text files within the content folder and all other files in the kirby and site folders. This is a security measure to avoid unwanted access to sensible files. Unfortunately it turns out that in …

And for Nginx? Do we have to change anything, currently we have something like: location ~.php$ { include /usr/local/etc/nginx/conf.d/php-fpm; } Adaptive Images - Resize images in folder, excluding those listed http://adaptive-images.com/ Nginx re-write code from https://gist.github.com/netPro…

You can test it by accessing any text file in your content directory, for example http://example.com/content/site.txt. If that redirects you to the full file system path, you have the same error. If it only redirects to http://example.com/error, everything is fine.

Thanks Lukas, I just had a test and it is slightly complicated with multi-language domain.com/content/site.md goes to rivieraremovals.com/error So that looks fine? But domain.com/en/content/site.md Goes to the error page, but leaves the url showing domain.com/en/content/site.md Any in…

The first one is a real URL to an existing file, so it’s caught by the rule in your config. The second URL is going to the index.php because it’s not linking to a real file. It’s caught by Kirby’s router and handled just like any other error page. That’s why no redirect kicks in and the URL stays th…

Thanks for the explanation Bastian, all good! We shall continue with our jolly little nginx server, safe in the knowledge we don’t have to change anything.

I noticed that with the above settings of the .htaccess file the content folder is not protected and that the structure of it with all its subfiles is visible. This is at least the case with my setup – maybe I miss something? Has anybody an idea how to prevent that without blocking images in subfold…

you should always switch off index listing on your server. That’s something that should be a standard on every production server in my opinion. It’s not just risky for Kirby, but for everything else on your machine.

Thank you @texnixe , that was a very useful and important hint! I did it with an index.php file. And I added a line in the .htaccess file. But wouldn’t it be good to have this setup in the starter kit, too? Now I noticed a different thing: everything is safe when I have an address like this: mysite/…

As Bastian wrote, directory indices should be disabled completely directly in the Apache configuration. Please ask your hosting provider to do so as other customers of that provider are affected by the same issue and it just doesn’t make sense to keep them enabled. Regarding your www issue: What do…

Security: Check your RewriteBase settings

Announcements

texnixe June 7, 2016, 7:11pm 11

To prevent that, you could just put a blank index.html file into the content folder.

Topic		Replies	Views
Very important security issue - most kirby website could be vulnerable to this attack Questions v2	14	3356	February 6, 2025
Content folder exposed despite correct htaccess rules Questions v3	6	482	April 17, 2025
Can not find&open project folder in browser Questions v3	5	671	December 29, 2021
404 not found for install(Kirby) Questions v2	2	586	February 6, 2025
NGINX / Apache2 Hybrid Server - RewriteRule ^content/(.*) index.php [L] Not working Questions	10	321	May 15, 2024

Security: Check your RewriteBase settings

Related topics