Skip to content

Commit d336fb3

Browse files
julienloizeletjulienloizelet
committed
feat(security): Protect cache and log folders with .htaccess
1 parent 41fd703 commit d336fb3

File tree

11 files changed

+87
-14
lines changed

11 files changed

+87
-14
lines changed

‎.cache/.htaccess‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<IfVersion < 2.4>
2+
order allow,deny
3+
deny from all
4+
</IfVersion>
5+
<IfVersion >= 2.4>
6+
Require all denied
7+
</IfVersion>
8+

‎.distignore‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
/.cache
21
/.git
32
/.github
43
/.githooks
@@ -25,10 +24,7 @@
2524
.composer.lock
2625
*.sh
2726
*.log
28-
README.md
29-
CHANGELOG.md
3027
composer.json
3128
composer.lock
32-
/logs/**
3329
.distignore
3430
.gitignore

‎.github/workflows/end-to-end-auto-prepend-test-suite.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ jobs:
5757
run: |
5858
echo "WP_VERSION_CODE=$(echo wp${{ matrix.wp-version }} | sed 's/\.//g' )" >> $GITHUB_ENV
5959
60-
- name: Create empty WordPress DDEV project
61-
run: ddev config --project-type=wordpress --project-name=${{ env.WP_VERSION_CODE }}
60+
- name: Create empty WordPress DDEV project (with Nginx)
61+
run: ddev config --project-type=wordpress --project-name=${{ env.WP_VERSION_CODE }} --webserver-type=nginx-fpm
6262

6363
- name: Handle PHP version
6464
run: |

‎.github/workflows/end-to-end-test-suite.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ jobs:
5757
run: |
5858
echo "WP_VERSION_CODE=$(echo wp${{ matrix.wp-version }} | sed 's/\.//g' )" >> $GITHUB_ENV
5959
60-
- name: Create empty WordPress DDEV project
61-
run: ddev config --project-type=wordpress --project-name=${{ env.WP_VERSION_CODE }} --php-version=${{ matrix.php-version }}
60+
- name: Create empty WordPress DDEV project (with Apache)
61+
run: ddev config --project-type=wordpress --project-name=${{ env.WP_VERSION_CODE }} --php-version=${{ matrix.php-version }} --webserver-type=apache-fpm
6262

6363
- name: Add Redis, Memcached, Crowdsec and Playwright
6464
run: |

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,11 @@ crowdsec-wp*
1616

1717
# App
1818
.bouncer-key
19-
.cache/
2019
*.log
20+
/.cache/*
21+
!/.cache/.htaccess
22+
/logs/*
23+
!/logs/.htaccess
2124
.vagrant
2225
.env
2326
inc/standalone-settings.php

‎CHANGELOG.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en)
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

77

8+
## [2.3.0](https://github.com/crowdsecurity/cs-wordpress-bouncer/releases/tag/v2.3.0) - 2023-04-06
9+
[_Compare with previous release_](https://github.com/crowdsecurity/cs-wordpress-bouncer/compare/v2.2.0...v2.3.0)
10+
11+
### Security
12+
13+
- Add `.htaccess` to deny direct access of log and cache folders
14+
15+
16+
---
17+
18+
819
## [2.2.0](https://github.com/crowdsecurity/cs-wordpress-bouncer/releases/tag/v2.2.0) - 2023-03-30
920
[_Compare with previous release_](https://github.com/crowdsecurity/cs-wordpress-bouncer/compare/v2.1.0...v2.2.0)
1021

‎docs/DEVELOPER.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,6 @@ ddev get ddev/ddev-redis
9090
ddev get ddev/ddev-memcached
9191
ddev get julienloizelet/ddev-tools
9292
ddev get julienloizelet/ddev-playwright
93-
ddev start
9493
```
9594

9695
- Launch DDEV
@@ -106,8 +105,7 @@ This should take some times on the first launch as this will download all necess
106105
```
107106
ddev wp core download
108107
109-
ddev exec wp core install --url='https://your-project-name.ddev.site' --title='WordPress' --admin_user='admin'
110-
--admin_password='admin123' --admin_email='admin@admin.com'
108+
ddev exec wp core install --url='https://your-project-name.ddev.site' --title='WordPress' --admin_user='admin' --admin_password='admin123' --admin_email='admin@admin.com'
111109
112110
```
113111

‎docs/USER_GUIDE.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -490,6 +490,54 @@ Here are some examples of how to set options with the `WP-CLI` tool.
490490

491491

492492

493+
### Security
494+
495+
Logs and cache files generated by this plugin must be protected from direct access attempts.
496+
497+
Logs files are created in the `wp-content/plugins/crowdses/logs` folder and cache files of the File system cache are
498+
created in the `wp-content/plugins/crowdses/.cache` folder.
499+
500+
**N.B.:**
501+
- There is no need to protect the `.cache` folder if you are using Redis or Memcached cache systems.
502+
- There is no need to protect the `logs` folder if you disable debug and prod logging.
503+
504+
#### Nginx
505+
506+
If you are using Nginx, you should add a directive in your website configuration file to deny access to these folders.
507+
508+
This could be done with the following snippet:
509+
510+
```
511+
server {
512+
...
513+
...
514+
...
515+
# Deny all attempts to acces log and cache folder of the crowdsec plugin
516+
location ~ /crowdsec/(.cache|logs) {
517+
deny all;
518+
}
519+
...
520+
...
521+
}
522+
```
523+
524+
#### Apache
525+
526+
If you are using Apache, these folders already contain the required `.htaccess` file:
527+
528+
```
529+
<IfVersion < 2.4>
530+
order allow,deny
531+
deny from all
532+
</IfVersion>
533+
<IfVersion >= 2.4>
534+
Require all denied
535+
</IfVersion>
536+
```
537+
538+
So you don't have to do anything more.
539+
540+
493541
### Auto Prepend File mode
494542

495543
By default, this extension will bounce every web requests that pass through the classical process of WordPress core loading.

‎inc/admin/advanced-settings.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,8 @@ function adminAdvancedSettings()
182182
return $input;
183183
}, ((Constants::CACHE_SYSTEM_PHPFS === get_option('crowdsec_cache_system')) ?
184184
'<input style="margin-right:10px" type="button" id="crowdsec_prune_cache" value="Prune now" class="button button-secondary" onclick="document.getElementById(\'crowdsec_action_prune_cache\').submit();">' : '').
185-
'<p>The File system cache is faster than calling Local API. Redis or Memcached is faster than the File System cache.</p>', [
185+
'<p>The File system cache is faster than calling Local API. Redis or Memcached is faster than the File System cache.<br>
186+
If you are using File system cache, please refer to <a target="_blank" href="https://github.com/crowdsecurity/cs-wordpress-bouncer/blob/main/docs/USER_GUIDE.md#security">the documentation to deny direct access to the cache folder.</a></p>', [
186187
Constants::CACHE_SYSTEM_PHPFS => 'File system',
187188
Constants::CACHE_SYSTEM_REDIS => 'Redis',
188189
Constants::CACHE_SYSTEM_MEMCACHED => 'Memcached',
@@ -371,7 +372,7 @@ function convertInlineIpRangesToComparableIpBounds(string $inlineIpRanges): arra
371372
******************************/
372373

373374
add_settings_section('crowdsec_admin_advanced_debug', 'Debug mode', function () {
374-
echo 'Configure the debug mode.';
375+
echo 'Configure the debug mode.<br>Please refer to <a target="_blank" href="https://github.com/crowdsecurity/cs-wordpress-bouncer/blob/main/docs/USER_GUIDE.md#security">the documentation to deny direct access to the log folder.</a>';
375376
}, 'crowdsec_advanced_settings');
376377

377378
// Field "crowdsec_debug_mode"

‎logs/.gitkeep‎

Whitespace-only changes.

0 commit comments

Comments
 (0)