wordpress: Restrict access to a few version discovery vectors

[chef.git] / cookbooks / nominatim / templates / default / apache.erb

diff --git a/cookbooks/nominatim/templates/default/apache.erb b/cookbooks/nominatim/templates/default/apache.erb
index 3eae1357a8883e06d7f563381a3becf266a899aa..230063643a46ebb815906796550cc1225ca27f6b 100644 (file)
--- a/cookbooks/nominatim/templates/default/apache.erb
+++ b/cookbooks/nominatim/templates/default/apache.erb
@@ -24,32 +24,15 @@
     DocumentRoot <%= @directory %>/website
     <Directory "<%= @directory %>/website/">
         DirectoryIndex search.php
     DocumentRoot <%= @directory %>/website
     <Directory "<%= @directory %>/website/">
         DirectoryIndex search.php

-        Options MultiViews FollowSymLinks
-        AddType text/html   .php
-        AddType application/xml   .phpx
-        AddType application/json   .phpj
-<% if node[:lsb][:release].to_f >= 14.04 -%>
+        Options FollowSymLinks

         Require all granted
         Require all granted

-<% end -%>

     </Directory>
 
     </Directory>
 

-    <LocationMatch /.*\.php[xj]?(/.*)?$>
-<% if node[:lsb][:release].to_f >= 14.04 -%>
-        ProxyPassMatch fcgi://127.0.0.1:<%= @pools[:www][:port ]%>/
-<% else -%>
-        SetHandler fcgi:/var/run/php5-fpm-www.sock
-<% end -%>
-    </LocationMatch>
+    ProxyPassMatch ^/([^/]*\.php(/.*)?)$ fcgi://127.0.0.1:<%= @pools[:www][:port ]%><%= @directory %>/website/$1

 
     <% @pools.each do |name,details| -%>
     Alias /pool-<%= name %>/ "<%= @directory %>/website/"
 
     <% @pools.each do |name,details| -%>
     Alias /pool-<%= name %>/ "<%= @directory %>/website/"

-    <LocationMatch /pool-<%= name %>/.*\.php[xj]?(/.*)?$>
-<% if node[:lsb][:release].to_f >= 14.04 -%>
-        ProxyPassMatch fcgi://127.0.0.1:<%= details[:port ]%>/
-<% else -%>
-        SetHandler fcgi:/var/run/php5-fpm-<%= name %>.sock
-<% end -%>
-    </LocationMatch>
+    ProxyPassMatch ^/pool-<%= name %>/(.*\.php(/.*)?) fcgi://127.0.0.1:<%= details[:port ]%><%= @directory %>/website/$1

     <% end -%>
 
     Redirect 429 /pool-block/
     <% end -%>
 
     Redirect 429 /pool-block/


@@ -70,7 +53,7 @@
 
     # regular requests and autoblocks
     RewriteMap bulklist txt:<%= @directory %>/settings/ip_blocks.map
 
     # regular requests and autoblocks
     RewriteMap bulklist txt:<%= @directory %>/settings/ip_blocks.map

-    RewriteRule ^/([sdr].*) /pool-${bulklist:%{REMOTE_ADDR}|www}/$1 [PT]
+    RewriteRule ^/(search|reverse|details)(\.php)?(/.*)? /pool-${bulklist:%{REMOTE_ADDR}|www}/$1.php$3 [PT]

 
 </VirtualHost>
 
 
 </VirtualHost>