litespeedtech / litespeedtech/lscache_wp
data/*.ini files are public when using OpenLiteSpeed Web Server
- Dominant language
- PHP
- Stars
- 257
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
Apache directives are not recognized in .htaccess files by OpenLiteSpeed Web Server (as described here: https://openlitespeed.org/kb/access-control/). To have these `litespeed-cache/data/*.ini` files non-accessible, an Apache rewrite should be used as well in the `litespeed-cache/data/.htaccess` file. I will make a PR to correct this bug.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with litespeed-cache/data/.htaccess and compare its current directives with the OpenLiteSpeed access-control guidance linked in the issue. Verify that the data/*.ini files are not publicly accessible when served by OpenLiteSpeed, while preserving the existing Apache behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100