- Issue created by @akalata
- 🇺🇸United States greggles Denver, Colorado, USA
It seems like this might be fixed by 📌 Always rename dot files like Drupal 7 Needs work .
This issue was discussed by the Drupal Security Team, and their decision was that this can be solved in a public issue.
This is a hardening follow-up to address cases where a cross-site content hijacking exploit could grant an attacker the ability to change allowed file types for upload. In order to mitigate damage, @davidstrauss recommends hard-forbidding uploading of .htaccess.
I'm not sure if we can set AllowOverride in our own .htaccess to restrict/disallow use of deeper ones, but that would also be good.
Active
11.0 🔥
file system
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
It seems like this might be fixed by 📌 Always rename dot files like Drupal 7 Needs work .