I got a note this morning saying that one of my sites was serving its .git directory. This is of course bad because the directory contains packed versions of all the source code of the site.

If you are using Git or any source control you can add a rule like this to Apache to prevent any dot files or directories from being served.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteLogLevel 0

# Do Not Serve Dot Files
RewriteRule (^\.|/\.) - [F]

</IfModule>

This will also prevent .DS_Store files and all manner of other =93invisible=94 dot files from being served. By default most Apache configurations only protect their own .htaccess and .htpasswd files. There are a couple different strategies in this Stack Overflow discussion.

http://stackoverflow.com/questions/4352737/apache-configuration-regex-to-disable-access-to-files-directories-beginning-wit

[fletcher]


#############################################################
This message is sent to you because you are subscribed to
the mailing list Lasso
Lasso@lists.lassosoft.com
To unsubscribe, E-mail to: <Lasso-unsubscribe@lists.lassosoft.com>
Send administrative queries to <Lasso-request@lists.lassosoft.com>