shaarli: update apache configuration as per shaarli/Shaarli#1630

nodiscc · Nov 12, 2020 · e3c2115 · e3c2115
1 parent c3aae86
commit e3c2115
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/roles/shaarli/templates/etc_apache2_sites-available_shaarli.conf.j2 b/roles/shaarli/templates/etc_apache2_sites-available_shaarli.conf.j2
@@ -35,15 +35,19 @@ MDomain {{ shaarli_fqdn }}
       Header always set Content-Security-Policy "script-src 'self' 'unsafe-inline' https://www.youtube.com https://s.ytimg.com; frame-ancestors 'none'"
   </Directory>
 
-  <LocationMatch "/\.">
-      # Prevent accessing dotfiles
-      RedirectMatch 404 ".*"
-  </LocationMatch>
+  # BE CAREFUL: directives order matter!
+  <FilesMatch ".*\.(?!(ico|css|js|gif|jpe?g|png|ttf|oet|woff2?)$)[^\.]*$">
+    Require all denied
+  </FilesMatch>
+
+  <Files "index.php">
+    Require all granted
+  </Files>
 
-  <LocationMatch "\.(?:ico|css|js|gif|jpe?g|png)$">
+  <FilesMatch "\.(?:ico|css|js|gif|jpe?g|png|ttf|oet|woff2)$">
       # allow client-side caching of static files
       Header set Cache-Control "max-age=2628000, public, must-revalidate, proxy-revalidate"
-  </LocationMatch>
+  </FilesMatch>
 
   # serve the Shaarli favicon from its custom location
   Alias favicon.ico /var/www/shaarli.mydomain.org/images/favicon.ico