Trying to get in touch regarding a security issue about yii2-advanced-one-domain-config HOT 9 CLOSED

@mickgeek - thanks for your response. Feel free to check out the issue here:

https://huntr.dev/bounties/c717b606-c214-4928-9fba-5588171e7b18/

from yii2-advanced-one-domain-config.

Thank you for the report.

In the configuration you can comment the block that prevent the redirect to the address with the trailing slash:

location = /admin {
    try_files $uri /backend/web/index.php$is_args$args;
}

After it the /admin request will be redirect automatically.

Also if you have a big project, follow these recommendations:

• define the user directive and use specific permissions to directories and files (e.g. 700 (-rwx------));
• separate the frontend and backend parts to different domains.

from yii2-advanced-one-domain-config.

If you need to use the apache.conf configuration, just comment the below rule:

RewriteRule ^/admin$ /admin/ [L,PT]

About permissions, any service can execute from any user. See also information about Suexec.

from yii2-advanced-one-domain-config.

Hi.

Thanks. You can write about a vulnerability here if it exists, just create a new issue.

from yii2-advanced-one-domain-config.

Is this limited to the included nginx configuration only or is it also present in the apache config?

from yii2-advanced-one-domain-config.

@mickgeek - if possible, are you able to update the status of the report?

from yii2-advanced-one-domain-config.

Sorry, I do not have an account on this site.

from yii2-advanced-one-domain-config.

@mickgeek - no worries 👍 Do you have an e-mail I can send a magic URL to? This will allow you to update the report without having to sign-up.

from yii2-advanced-one-domain-config.

You can find contacts on the profile page.

from yii2-advanced-one-domain-config.