Merge pull request #1592 from hestiacp/security/1589-hide-hidden-files

Hide hidden files by default

install/deb/templates/web/nginx/php-fpm/cms_made_simple.stpl

@@ -44,11 +44,10 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
-
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;
         include %home%/%user%/web/%domain%/stats/auth.conf*;

install/deb/templates/web/nginx/php-fpm/cms_made_simple.tpl

@@ -39,9 +39,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+   location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/codeigniter2.stpl

@@ -49,9 +49,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/codeigniter2.tpl

@@ -44,9 +44,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/codeigniter3.stpl

@@ -44,10 +44,10 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
-    }
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
+    }    
 
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;

install/deb/templates/web/nginx/php-fpm/codeigniter3.tpl

@@ -40,9 +40,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/datalife_engine.stpl

@@ -115,9 +115,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/datalife_engine.tpl

@@ -1,4 +1,7 @@
-#=======================================================================#
+location ~ /\.(?!well-known\/) { 
+   deny all; 
+   return 404;
+}#=======================================================================#
 # Default Web Domain Template                                           #
 # DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
 #=======================================================================#
@@ -110,9 +113,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/default.stpl

@@ -43,9 +43,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/default.tpl

@@ -38,9 +38,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/dokuwiki.stpl

@@ -60,9 +60,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/dokuwiki.tpl

@@ -54,9 +54,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/drupal6.stpl

@@ -82,9 +82,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/drupal6.tpl

@@ -77,9 +77,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/joomla.stpl

@@ -56,9 +56,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) {
+        deny all;
+        return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/joomla.tpl

@@ -51,9 +51,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) {
+        deny all;
+        return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/laravel.stpl

@@ -43,9 +43,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) {
+        deny all;
+        return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/laravel.tpl

@@ -37,9 +37,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/magento.stpl

@@ -192,8 +192,9 @@ server {
     gzip_vary on;
 
     # Banned locations (only reached if the earlier PHP entry point regexes don't match)
-    location ~* (\.php$|\.htaccess$|\.git) {
-        deny all;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/magento.tpl

@@ -187,8 +187,9 @@ server {
     gzip_vary on;
 
     # Banned locations (only reached if the earlier PHP entry point regexes don't match)
-    location ~* (\.php$|\.htaccess$|\.git) {
-        deny all;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/modx.stpl

@@ -58,9 +58,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/modx.tpl

@@ -52,9 +52,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/moodle.stpl

@@ -78,9 +78,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/moodle.tpl

@@ -74,9 +74,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/no-php.stpl

@@ -34,9 +34,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/no-php.tpl

@@ -29,9 +29,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/odoo.stpl

@@ -33,8 +33,9 @@ server {
     send_timeout            720;
 
     # Allow "Well-Known URIs" as per RFC 5785
-    location ~* ^/.well-known/ {
-        allow all;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location / {
@@ -56,11 +57,6 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
-    }
-
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;
         include %home%/%user%/web/%domain%/stats/auth.conf*;

install/deb/templates/web/nginx/php-fpm/odoo.tpl

@@ -28,8 +28,9 @@ server {
     send_timeout            720;
 
     # Allow "Well-Known URIs" as per RFC 5785
-    location ~* ^/.well-known/ {
-        allow all;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location / {
@@ -51,11 +52,6 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
-    }
-
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;
         include %home%/%user%/web/%domain%/stats/auth.conf*;

install/deb/templates/web/nginx/php-fpm/opencart.stpl

@@ -57,9 +57,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     include     /etc/nginx/conf.d/phpmyadmin.inc*;

install/deb/templates/web/nginx/php-fpm/opencart.tpl

@@ -51,9 +51,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     include     /etc/nginx/conf.d/phpmyadmin.inc*;

install/deb/templates/web/nginx/php-fpm/osticket.stpl

@@ -78,9 +78,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/osticket.tpl

@@ -73,9 +73,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/owncloud.stpl

@@ -38,9 +38,14 @@ server {
     error_page 404 = /core/templates/404.php;
     error_page 500 502 503 504 /error/50x.html;
 
-    location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
+    location ~ ^/(?:\data|config|db_structure\.xml|README){
         deny all;
     }
+    
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
+    }
 
     location / {
         # The following 2 rules are only needed with webfinger
@@ -75,11 +80,6 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
-    }
-
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;
         include %home%/%user%/web/%domain%/stats/auth.conf*;

install/deb/templates/web/nginx/php-fpm/owncloud.tpl

@@ -33,9 +33,14 @@ server {
     error_page 404 = /core/templates/404.php;
     error_page 500 502 503 504 /error/50x.html;
 
-    location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
+    location ~ ^/(?:\data|config|db_structure\.xml|README){
         deny all;
     }
+    
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
+    }
 
     location / {
         # The following 2 rules are only needed with webfinger
@@ -70,11 +75,6 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
-    }
-
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;
         include %home%/%user%/web/%domain%/stats/auth.conf*;

install/deb/templates/web/nginx/php-fpm/piwik.stpl

@@ -61,9 +61,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/piwik.tpl

@@ -56,9 +56,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/pyrocms.stpl

@@ -54,9 +54,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/pyrocms.tpl

@@ -49,10 +49,10 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
-    }
+     location ~ /\.(?!well-known\/) { 
+        deny all; 
+        return 404;
+     }
 
     location /vstats/ {
         alias   %home%/%user%/web/%domain%/stats/;

install/deb/templates/web/nginx/php-fpm/sendy.stpl

@@ -29,8 +29,9 @@ server {
         access_log off;
     }
 
-    location ~* "/\.(htaccess|htpasswd|git|svn|DS_Store)$" {
-        deny all;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location ~ /(readme.html|license.txt) {

install/deb/templates/web/nginx/php-fpm/sendy.tpl

@@ -25,8 +25,9 @@ server {
         access_log off;
     }
 
-    location ~* "/\.(htaccess|htpasswd|git|svn|DS_Store)$" {
-        deny all;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location ~ /(readme.html|license.txt) {

install/deb/templates/web/nginx/php-fpm/wordpress.stpl

@@ -60,9 +60,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {

install/deb/templates/web/nginx/php-fpm/wordpress.tpl

@@ -55,9 +55,9 @@ server {
         alias   %home%/%user%/web/%domain%/document_errors/;
     }
 
-    location ~* "/\.(htaccess|htpasswd)$" {
-        deny    all;
-        return  404;
+    location ~ /\.(?!well-known\/) { 
+       deny all; 
+       return 404;
     }
 
     location /vstats/ {