Securing RosarioSIS

This site is best viewed in a modern browser with JavaScript enabled.

moussa

Dear all,
I am trying to make sure that I secur my RosarioSIS. I set session.use_strict_mode = 1 . I applied 7G Blacklist . I have enforced HTTPS . but I am concerned that the files in my root directory are downloadable . I feel there should be some restrictions for some file type and directory that do ot need to be accessed from the browser?

Do you have any suggestion to secure the files and directories in the root folder?

francoisjacquet

Hello moussa

For security matters, you can consult this Wiki page.
Please be careful, the 6G Blacklist is recommended, not the 7G.

I am preparing a .htaccess file with rules specially crafted for RosarioSIS, if you want to give it a try:

<IfModule mod_rewrite.c>

RewriteEngine On

## Begin - Security
# Block direct access to files inside the vendor folders
RewriteRule /vendor/.*$ - [F]
# Block direct access to .md and .sql files except for those uploaded to assets/FileUploads/
RewriteRule ^(?!assets/FileUploads/).*\.(md|sql)$ - [F]
# Block direct access to files and folders beginning with a dot
RewriteRule (^|/)\.(?!well-known) - [F]
# Block access to specific files
RewriteRule (^|/)(LICENSE|COPYRIGHT|composer\.lock|composer\.json|package\.json|\.htaccess)$ - [F]
#
## End - Security

</IfModule>

In a future version too, the PDF files in the root folder will be removed.

moussa

Dear francoisjacquet ,
Thank you for your help. I applied your directive and tried to access a file from outside and I got "Forbidden
You don't have permission to access this resource."

Thank you so much