Skip to content

Comment on Using SVN makes your site extremely vulnerable

Comments

For your Apache config.

  # Disallow viewing of .svn and .git directory contents
  <DirectoryMatch \.(svn|git)>
    Order allow,deny
    Deny from all
  </DirectoryMatch>

May as well throw in .hg

Oh. Now we're blacklisting.

If you are going to use this solution, you are better off blacklisting all dotfiles except .htaccess, assuming you allow it.

Even if you do use .htaccess files, you still shouldn't be showing them to anyone who requests them from your web server!

Ha! Correct!

For Nginx:

location ~ /\.(svn|git) { deny all; }

  # Disallow viewing of .svn and .git and .hg directory contents
  <Directory ~ \.(svn|git|hg)>
    Order allow,deny
    Deny from all
  </Directory>

As well as leaving .gitignore exposed also.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.