[GH-ISSUE #103] csv files in /data are accessible #78

New issue

Closed

opened 2026-02-25 23:40:36 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 23:40:36 +03:00

Owner

Originally created by @thomasdeurloo on GitHub (Nov 13, 2019).
Original GitHub issue: https://github.com/HaschekSolutions/pictshare/issues/103

Hi,

The folder "data" contains the sha1.csv which is containing the hashes. My folder is also containing a file called "uploads.csv" containing the logged uploads.. (I assume that the presence of this file is dependend on the parameter to log uploads). The csv files are publicly accessible to everyone. So if one knows that this system is used, he can request a full overview of the sha1 hashes, and in case of the logged uploads also the ipadresses.

To prevent this i created an .htacces file in the data folder containing

<FilesMatch "\.(php|pl|py|jsp|exe|flv|csv|asp|htm|shtml|sh|cgi)$">
Deny from All
</FilesMatch>

Which is blocking access to requests on csv files (as well as some others then uploaded content, just to be sure). Is this the best way of doing this?

Originally created by @thomasdeurloo on GitHub (Nov 13, 2019). Original GitHub issue: https://github.com/HaschekSolutions/pictshare/issues/103 Hi, The folder "data" contains the sha1.csv which is containing the hashes. My folder is also containing a file called "uploads.csv" containing the logged uploads.. (I assume that the presence of this file is dependend on the parameter to log uploads). The csv files are publicly accessible to everyone. So if one knows that this system is used, he can request a full overview of the sha1 hashes, and in case of the logged uploads also the ipadresses. To prevent this i created an .htacces file in the data folder containing ``` <FilesMatch "\.(php|pl|py|jsp|exe|flv|csv|asp|htm|shtml|sh|cgi)$"> Deny from All </FilesMatch> ``` Which is blocking access to requests on csv files (as well as some others then uploaded content, just to be sure). Is this the best way of doing this?

kerem closed this issue

2026-02-25 23:40:36 +03:00

kerem commented

2026-02-25 23:40:36 +03:00

Author

Owner

@geek-at commented on GitHub (Nov 13, 2019):

Thanks, will add it to the nginx config

In the install example I use this as the default:

location ~ /(data|tmp|bin|content-controllers|inc|interfaces|storage-controllers|templates|tools) {
deny all;
return 404;
}

@geek-at commented on GitHub (Nov 13, 2019): Thanks, will add it to the nginx config In the install example I use this as the default: location ~ /(data|tmp|bin|content-controllers|inc|interfaces|storage-controllers|templates|tools) { deny all; return 404; }

kerem referenced this issue

2026-02-25 23:40:57 +03:00

[PR #78] [MERGED] V2 #154