From 4834c326aa695097add9786645fa252112e9a9f8 Mon Sep 17 00:00:00 2001
From: bruno DA SILVA <bruno.dasilva@combodo.com>
Date: Wed, 30 Oct 2019 15:45:21 +0100
Subject: [PATCH] 2498 - restrict access to assets into env-*

 - allow static html into extensions/ and datamodels/
 - allow direct access to php into env-* for legacy code taht do not use exec.php
---
 datamodels/.htaccess         | 4 ++--
 datamodels/web.config        | 6 ++++--
 extensions/.htaccess         | 4 ++--
 extensions/web.config        | 6 ++++--
 setup/compiler.class.inc.php | 8 ++++++--
 5 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/datamodels/.htaccess b/datamodels/.htaccess
index 736fc7a95..17ac87ba5 100644
--- a/datamodels/.htaccess
+++ b/datamodels/.htaccess
@@ -1,7 +1,7 @@
 # Apache 2.4
 <ifModule mod_authz_core.c>
 Require all denied
-	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot)$">
+	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot|html)$">
 	    Require all granted
 	</FilesMatch>
 </ifModule>
@@ -10,7 +10,7 @@ Require all denied
 <ifModule !mod_authz_core.c>
 deny from all
 Satisfy All
-	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot)$">
+	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot|html)$">
 	    Order Allow,Deny
 	    Allow from all
 	</FilesMatch>
diff --git a/datamodels/web.config b/datamodels/web.config
index dd0c16efc..a67d0f2d5 100644
--- a/datamodels/web.config
+++ b/datamodels/web.config
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
-  <system.web>
+  <system.webServer>
       <security>
          <requestFiltering>
             <fileExtensions applyToWebDAV="false" allowUnlisted="false" >
@@ -19,8 +19,10 @@
                <add fileExtension=".woff2" allowed="true" />
                <add fileExtension=".ttf" allowed="true" />
                <add fileExtension=".eot" allowed="true" />
+
+               <add fileExtension=".html" allowed="true" />
             </fileExtensions>
          </requestFiltering>
       </security>
-  </system.web>
+  </system.webServer>
 </configuration>
\ No newline at end of file
diff --git a/extensions/.htaccess b/extensions/.htaccess
index 736fc7a95..17ac87ba5 100644
--- a/extensions/.htaccess
+++ b/extensions/.htaccess
@@ -1,7 +1,7 @@
 # Apache 2.4
 <ifModule mod_authz_core.c>
 Require all denied
-	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot)$">
+	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot|html)$">
 	    Require all granted
 	</FilesMatch>
 </ifModule>
@@ -10,7 +10,7 @@ Require all denied
 <ifModule !mod_authz_core.c>
 deny from all
 Satisfy All
-	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot)$">
+	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot|html)$">
 	    Order Allow,Deny
 	    Allow from all
 	</FilesMatch>
diff --git a/extensions/web.config b/extensions/web.config
index dd0c16efc..a67d0f2d5 100644
--- a/extensions/web.config
+++ b/extensions/web.config
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
-  <system.web>
+  <system.webServer>
       <security>
          <requestFiltering>
             <fileExtensions applyToWebDAV="false" allowUnlisted="false" >
@@ -19,8 +19,10 @@
                <add fileExtension=".woff2" allowed="true" />
                <add fileExtension=".ttf" allowed="true" />
                <add fileExtension=".eot" allowed="true" />
+
+               <add fileExtension=".html" allowed="true" />
             </fileExtensions>
          </requestFiltering>
       </security>
-  </system.web>
+  </system.webServer>
 </configuration>
\ No newline at end of file
diff --git a/setup/compiler.class.inc.php b/setup/compiler.class.inc.php
index 68c415e50..be428b748 100644
--- a/setup/compiler.class.inc.php
+++ b/setup/compiler.class.inc.php
@@ -2932,7 +2932,7 @@ EOF;
 # Apache 2.4
 <ifModule mod_authz_core.c>
 Require all denied
-	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot)$">
+	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot|html|php)$">
 	    Require all granted
 	</FilesMatch>
 </ifModule>
@@ -2941,7 +2941,7 @@ Require all denied
 <ifModule !mod_authz_core.c>
 deny from all
 Satisfy All
-	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot)$">
+	<FilesMatch ".+\.(css|scss|js|png|bmp|gif|jpe?g|svg|tiff|woff2?|ttf|eot|html|php)$">
 	    Order Allow,Deny
 	    Allow from all
 	</FilesMatch>
@@ -2990,6 +2990,10 @@ EOF;
                <add fileExtension=".woff2" allowed="true" />
                <add fileExtension=".ttf" allowed="true" />
                <add fileExtension=".eot" allowed="true" />
+               
+               <add fileExtension=".html" allowed="true" />
+               
+               <add fileExtension=".php" allowed="true" />
             </fileExtensions>
          </requestFiltering>
       </security>