From: Pablo Zmdl <redacted>
Date: Mon, 2 Dec 2024 06:55:03 +0000 (+0100)
Subject: Protect default `temp_dir` and `log_dir` from remote access
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=8ee5f5dd2a38dad7ae1d8407d1bc26b22c0a28af;p=roundcube-roundcubemail-docker.git

Protect default `temp_dir` and `log_dir` from remote access

The .htaccess doesn't work in nginx
---

diff --git a/examples/nginx/templates/default.conf.template b/examples/nginx/templates/default.conf.template
index ae7ee20..93f4be9 100644
--- a/examples/nginx/templates/default.conf.template
+++ b/examples/nginx/templates/default.conf.template
@@ -5,6 +5,11 @@ server {
     access_log /var/log/nginx/access.log;
     root /var/www/html;
 
+    location ~ /(temp|logs)/ {
+        deny all;
+        return 403;
+    }
+
     location ~ \.php$ {
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;