diff --git a/news/trunk/htaccess.txt b/news/trunk/htaccess.txt new file mode 100644 index 00000000..1e165ebe --- /dev/null +++ b/news/trunk/htaccess.txt @@ -0,0 +1,67 @@ +## +# @version $Id: htaccess.txt 10492 2008-07-02 06:38:28Z ircmaxell $ +# @package Joomla +# @copyright Copyright (C) 2005 - 2008 Open Source Matters. All rights reserved. +# @license http://www.gnu.org/copyleft/gpl.html GNU/GPL +# Joomla! is Free Software +## + + +##################################################### +# READ THIS COMPLETELY IF YOU CHOOSE TO USE THIS FILE +# +# The line just below this section: 'Options +FollowSymLinks' may cause problems +# with some server configurations. It is required for use of mod_rewrite, but may already +# be set by your server administrator in a way that dissallows changing it in +# your .htaccess file. If using it causes your server to error out, comment it out (add # to +# beginning of line), reload your site in your browser and test your sef url's. If they work, +# it has been set by your server administrator and you do not need it set here. +# +##################################################### + +## Can be commented out if causes errors, see notes above. +Options +FollowSymLinks + +# +# mod_rewrite in use + +RewriteEngine On + +########## Begin - Rewrite rules to block out some common exploits +## If you experience problems on your site block out the operations listed below +## This attempts to block the most common type of exploit `attempts` to Joomla! +# +# Block out any script trying to set a mosConfig value through the URL +RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR] +# Block out any script trying to base64_encode crap to send via URL +RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] +# Block out any script that includes a