html/_drf/.htaccess changed

[klml]

There is a new file on the demo (at 18.00)

html/_drf/.htaccess.before-uberspace-change

and changed

html/_drf/.htaccess

again a change (at 18.50) in

html/_drf/.htaccess

but no diff:

[drf@grus html]$ diff .htaccess .htaccess.before-uberspace-change
[drf@grus html]$

I assume the second change reverted the first

[klml]

With known credentials (a:a) you have also access via POST to _drf

~$ curl --data "drf_sourcepath=_drf/.htaccess&content=lorem" http://a:a@drf.grus.uberspace.de/_drf/make.php
[SUCCESS] written: ../_drf/.htaccess

There is still a TODO to prevent Directory traversal attack on and close edits to source _drf/lib/Tools.php#L21

[klml]

The new file was from a hoster config change: Last but not least hinterlassen wir bei einer erfolgten Änderung eine .htaccess.before-uberspace-change, ...

But the Problem is still existing, but not major.