Improve uploads folder security - closes #3428

freescout-help-desk · Sep 27, 2023 · 1daa34f · 1daa34f
1 parent 258b774
commit 1daa34f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/storage/app/public/.htaccess b/storage/app/public/.htaccess
@@ -1,3 +1,4 @@
+# The list should be in sync with /config/app.php and nginx config.
 <FilesMatch "\.((?!(jpg|jpeg|jfif|pjpeg|pjp|apng|bmp|gif|ico|cur|png|tif|tiff|webp|pdf|txt|diff|patch|json|mp3|wav|ogg|wma)).)*$">
    ForceType application/octet-stream
    Header set Content-Disposition attachment

diff --git a/tools/install.sh b/tools/install.sh
@@ -156,6 +156,11 @@ sudo echo 'server {
         access_log off;
         add_header Cache-Control "public, must-revalidate";
     }
+    # The list should be in sync with /storage/app/public/uploads/.htaccess and /config/app.php
+    location ~* ^/storage/.*\.((?!(jpg|jpeg|jfif|pjpeg|pjp|apng|bmp|gif|ico|cur|png|tif|tiff|webp|pdf|txt|diff|patch|json|mp3|wav|ogg|wma)).)*$ {
+        add_header Content-disposition "attachment; filename=$1";
+        default_type application/octet-stream;
+    }	
     location ~* ^/(?:css|fonts|img|installer|js|modules|[^\\\]+\..*)$ {
         expires 1M;
         access_log off;