error log is world readable????

I just did a google search for something & saw one of my sites modx error logs come up in the search results!

checked a few more sites and the same thing, checked more sites from the mods site gallery ... again - the same thing!

I can browse to anysite.com/core/cache/logs/error.log and view that sites error log!!!

How can we prevent this? Logs should not be world readable.

I imagine this is precisely why there's an extensive section in the docs dedicated to hardening MODX with an advanced installation, and moving the core above the root.

Which is something I've never bothered with, I'm sure like many others. Makes you think, eh?

You definitely should have a robots.txt file, denying everything in the core, assets, connectors and manager folders. That will at least keep it out of the search engine results.

use .htaccess

btw, I prefer to use Advanced installation, where I can move the core folder out of the web root.
Since then, the world is not only unable to see the error log, but the whole component's files.

Quote from: goldsky at Oct 09, 2012, 02:33 AM

use .htaccess

btw, I prefer to use Advanced installation, where I can move the core folder out of the web root.
Since then, the world is not only unable to see the error log, but the whole component's files.

what did you do in an .htaccess? a rewrite/redirect?

You can easily rename the ht.access in the core folder, which prevents direct access via the web server to any file in that location.

never noticed this file before... why wouldn't it be enabled by default? Seems to make more sense at first look.

http://www.htaccess-guide.com/
is a good start to learn .htaccess.
there is also .htpasswd.

just google them.
you'll see.

btw, it's for Apache server.
IIS does different way. [ed. note: goldsky last edited this post 14 years ago.]

Quote from: sean69 at Oct 09, 2012, 10:53 AM

never noticed this file before... why wouldn't it be enabled by default? Seems to make more sense at first look.

Same reason none of the included ht.access files are enabled by default. We don't want upgrades overwriting any customizations folks have made in those files. If we included them as .htaccess in the distributions, those local changes would be lost on every upgrade.

At some point, I would love to have a process that automatically updated these as a step during setup, where possible, though I imagine having your .htaccess files writable by your PHP process is generally not a good idea. That is something we need to consider when adding such a feature.

More and more hosts are using alternative webservers such as nginx (<cough> MODx Cloud <cough>), so default .htaccess files wouldn't be of much use there anyway.