bbd5f28415
Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
55 lines
1.8 KiB
ApacheConf
55 lines
1.8 KiB
ApacheConf
# Version: 8.1.0
|
|
<IfModule mod_fcgid.c>
|
|
<IfModule mod_setenvif.c>
|
|
<IfModule mod_headers.c>
|
|
SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1
|
|
RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION
|
|
</IfModule>
|
|
</IfModule>
|
|
</IfModule>
|
|
<IfModule mod_php5.c>
|
|
php_value upload_max_filesize 513M
|
|
php_value post_max_size 513M
|
|
php_value memory_limit 512M
|
|
php_value mbstring.func_overload 0
|
|
php_value always_populate_raw_post_data -1
|
|
php_value default_charset 'UTF-8'
|
|
php_value output_buffering off
|
|
<IfModule mod_env.c>
|
|
SetEnv htaccessWorking true
|
|
</IfModule>
|
|
</IfModule>
|
|
<IfModule mod_rewrite.c>
|
|
RewriteEngine on
|
|
RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
|
|
RewriteRule ^\.well-known/host-meta /public.php?service=host-meta [QSA,L]
|
|
RewriteRule ^\.well-known/host-meta\.json /public.php?service=host-meta-json [QSA,L]
|
|
RewriteRule ^\.well-known/carddav /remote.php/carddav/ [R]
|
|
RewriteRule ^\.well-known/caldav /remote.php/caldav/ [R]
|
|
RewriteRule ^apps/calendar/caldav\.php remote.php/caldav/ [QSA,L]
|
|
RewriteRule ^apps/contacts/carddav\.php remote.php/carddav/ [QSA,L]
|
|
RewriteRule ^remote/(.*) remote.php [QSA,L]
|
|
RewriteRule ^(build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
|
|
RewriteRule ^(\.|autotest|occ|issue|indie|db_|console).* - [R=404,L]
|
|
</IfModule>
|
|
<IfModule mod_mime.c>
|
|
AddType image/svg+xml svg svgz
|
|
AddEncoding gzip svgz
|
|
</IfModule>
|
|
<IfModule mod_dir.c>
|
|
DirectoryIndex index.php index.html
|
|
</IfModule>
|
|
AddDefaultCharset utf-8
|
|
Options -Indexes
|
|
<IfModule pagespeed_module>
|
|
ModPagespeed Off
|
|
</IfModule>
|
|
<IfModule mod_headers.c>
|
|
Header set X-Content-Type-Options "nosniff"
|
|
Header set X-XSS-Protection "1; mode=block"
|
|
Header set X-Robots-Tag "none"
|
|
Header set X-Frame-Options "SAMEORIGIN"
|
|
<FilesMatch "\.(css|js)$">
|
|
Header set Cache-Control "max-age=7200, public"
|
|
</FilesMatch>
|
|
</IfModule>
|