getgrav/grav 1.7.53.8

on GitHub

Bugfix

• [security] The root .htaccess also keeps the tmp/ folder private, refuses scripts in images/ and assets/, and refuses requests in images/, assets/, system/, vendor/ and user/ that map to a file with a path after it, and upgrading adds these rules to an existing site's .htaccess. Backport of the Grav 2 rules
• [security] The bundled IIS web.config applies its rules in any letter case and however a file path is written, and also keeps hidden files, .env files, tmp/, root files such as composer.json, Markdown files and scripts in images/ and assets/ private (IIS sites copy the updated rules from webserver-configs/ by hand). Backport of the Grav 2 rules
• [security] The bundled nginx.conf also keeps hidden files, .env files, tmp/, webserver-configs/, Markdown files and scripts in images/ and assets/ private, and its folder rules match from the site root only, so page routes such as /docs/cache/ reach Grav (nginx sites copy the updated rules from webserver-configs/ by hand). Backport of the Grav 2 rules
• [security] The bundled Caddy 2 Caddyfile is rebuilt so every deny rule takes effect, and both Caddyfiles protect the same folders and file types as the Apache rules (Caddy sites copy the updated rules from webserver-configs/ by hand). Backport of the Grav 2 rules
• [security] The bundled lighttpd.conf matches its rules in any letter case, serves /.well-known/ files such as ACME challenges, and protects the same folders and file types as the Apache rules (lighttpd sites copy the updated rules from webserver-configs/ by hand). Backport of the Grav 2 rules
• [security] The php -S development router (system/router.php) keeps tmp/, user/config/, user/env/, user/accounts/ and user/data/ private and refuses scripts in images/ and assets/, the same as the shipped web-server rules. Backport of the Grav 2 rules
• [security] The Apache .htaccess exception for /.well-known/ now covers that folder only, so other hidden files and folders whose names start with well-known stay blocked. Upgrading updates existing .htaccess files