diff options
| author | Mike Macgirvin <mike@macgirvin.com> | 2018-10-31 15:56:08 +1100 |
|---|---|---|
| committer | Mike Macgirvin <mike@macgirvin.com> | 2018-10-31 15:56:08 +1100 |
| commit | 7e1f431eca7a8aa68fc0badfaa88e88de3ba094c (patch) | |
| tree | 16beba352cd4ace4aa6eb13c7f9c1c82c92013b4 /vendor/blueimp/jquery-file-upload/server/php/files | |
| parent | 70c55da1df69d90dcbeb5a78c994b23a8456bfc9 (diff) | |
| download | volse-hubzilla-7e1f431eca7a8aa68fc0badfaa88e88de3ba094c.tar.gz volse-hubzilla-7e1f431eca7a8aa68fc0badfaa88e88de3ba094c.tar.bz2 volse-hubzilla-7e1f431eca7a8aa68fc0badfaa88e88de3ba094c.zip | |
yet another blueimp vulnerability. Move to composer.
Diffstat (limited to 'vendor/blueimp/jquery-file-upload/server/php/files')
| -rw-r--r-- | vendor/blueimp/jquery-file-upload/server/php/files/.gitignore | 3 | ||||
| -rw-r--r-- | vendor/blueimp/jquery-file-upload/server/php/files/.htaccess | 26 |
2 files changed, 29 insertions, 0 deletions
diff --git a/vendor/blueimp/jquery-file-upload/server/php/files/.gitignore b/vendor/blueimp/jquery-file-upload/server/php/files/.gitignore new file mode 100644 index 000000000..e24a60fae --- /dev/null +++ b/vendor/blueimp/jquery-file-upload/server/php/files/.gitignore @@ -0,0 +1,3 @@ +* +!.gitignore +!.htaccess diff --git a/vendor/blueimp/jquery-file-upload/server/php/files/.htaccess b/vendor/blueimp/jquery-file-upload/server/php/files/.htaccess new file mode 100644 index 000000000..6f454afb9 --- /dev/null +++ b/vendor/blueimp/jquery-file-upload/server/php/files/.htaccess @@ -0,0 +1,26 @@ +# To enable the Headers module, execute the following command and reload Apache: +# sudo a2enmod headers + +# The following directives prevent the execution of script files +# in the context of the website. +# They also force the content-type application/octet-stream and +# force browsers to display a download dialog for non-image files. +SetHandler default-handler +ForceType application/octet-stream +Header set Content-Disposition attachment + +# The following unsets the forced type and Content-Disposition headers +# for known image files: +<FilesMatch "(?i)\.(gif|jpe?g|png)$"> + ForceType none + Header unset Content-Disposition +</FilesMatch> + +# The following directive prevents browsers from MIME-sniffing the content-type. +# This is an important complement to the ForceType directive above: +Header set X-Content-Type-Options nosniff + +# Uncomment the following lines to prevent unauthorized download of files: +#AuthName "Authorization required" +#AuthType Basic +#require valid-user |