CODEWITHSUNDEEP
gitsecurity.htaccess
piku
piku

Reputation: 71

Make the deny from all for .git directory more user friendly

RE: Make .git directory web inaccessible

I currently have the following:

<Directorymatch "^/.*/\.git/">
    Order deny,allow
    Deny from all
</Directorymatch>

Instead of a 500 error page, is there a way to modify the .htaccess code above to make it just go to the main domain? Thanks in advance.

UPDATE

I also have the following mod_rewrite which got me closer:

RewriteEngine On
RewriteRule "^(.*/)?\.git/" http://%{HTTP_HOST}/? [L]

However, it only triggers if its "domain.com/.git" and not any child .git folders. E.g.

domain.com/folder/.git
domain.com/folder/sub-folder/.git

Thanks in advance for the help.

Upvotes: 0

Views: 686

Answers (1)

piku
piku

Reputation: 71

Alright, this seems to work for what I was asking.

Solution 1. If you would like to redirect to the domain root (w/ mod_rewrite):

RewriteEngine On
RewriteRule ^(.*/)?\.git+ http://%{HTTP_HOST}/? [L]

Solution 2. If you would like to issue a 404 (w/ mod_rewrite):

RewriteEngine On
RewriteRule ^(.*/)?\.git+ - [R=404,L]

Fallback solution. if mod_rewrite ain't available:

RedirectMatch 404 ^(.*/)?\.git+

I went with Solution 2, and the fallback. I hope that helps.

Upvotes: 3

Related Questions