server/config/.htaccess

# line below if for Apache 2.4
<ifModule mod_authz_core.c>
Require all denied
</ifModule>

# line below if for Apache 2.2
<ifModule !mod_authz_core.c>
deny from all
</ifModule>

# section for Apache 2.2 and 2.4
<ifModule mod_autoindex.c>
IndexIgnore *
</ifModule>
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-) 2014-04-24 06:33:58 +00:00			`# line below if for Apache 2.4`
Reference module with `.c` Fixes https://github.com/owncloud/core/issues/13657 2015-01-28 11:42:15 +00:00			`<ifModule mod_authz_core.c>`
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-) 2014-04-24 06:33:58 +00:00			`Require all denied`
			`</ifModule>`

			`# line below if for Apache 2.2`
Reference module with `.c` Fixes https://github.com/owncloud/core/issues/13657 2015-01-28 11:42:15 +00:00			`<ifModule !mod_authz_core.c>`
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-) 2014-04-24 06:33:58 +00:00			`deny from all`
			`</ifModule>`

			`# section for Apache 2.2 and 2.4`
Only request "IndexIgnore" if mod_autoindex is loaded Signed-off-by: Robert Scheck <robert@fedoraproject.org> 2017-02-16 10:45:11 +00:00			`<ifModule mod_autoindex.c>`
Preventing access to the config folder It isn't uncommon that admins create a backup file of the config (i.e. `config.php.bak`) before performing any changes. This would allow everybody to read the backup of the configuration file which contain several secret and critical values. I don't believe this is worth a backport or getting added to the installer. It's just a nice to have. People that create public readable backups of their configuration are the one to blame, not us :-) 2014-04-24 06:33:58 +00:00			`IndexIgnore *`
Only request "IndexIgnore" if mod_autoindex is loaded Signed-off-by: Robert Scheck <robert@fedoraproject.org> 2017-02-16 10:45:11 +00:00			`</ifModule>`