Your web server is not applying Grav's access rules

Support apps
, ,
1

I have searched the forum for similar issues

on

This category is for issues regarding specific apps, NOT general issues with YunoHost.

on

This form is written in English but feel free to write in French if you’re more comfortable!

on

What app is this about, and its version

Grav, v2.0.21

What YunoHost version are you running

12.1.40.1

What type of hardware are you using

Old laptop or computer

Describe your issue

Since I updgraded to Grav 2.0.21 I get this error message

Your web server is not applying Grav’s access rules
Your web server is not applying Grav’s recommended access rules, so files in user/ can be reached directly over the web. It is worth tightening up, since some plugins do store data here.
How to fix this

The issue can be fixed in Ngnix config but I guess it’s better if the Yunohost package does it by default.

Share relevant logs or error messages

Your web server is not applying Grav’s recommended access rules, so files in user/ can be reached directly over the web. It is worth tightening up, since some plugins do store data here.

2

yeah grav 2 started actually checking this instead of just warning. yunohost is nginx so the apache rules in the grav tree never apply, thats why it showed up after the upgrade. you can drop a snippet in the app extra nginx conf denying /user/ (and cache/backup/logs) with 403 then reload. longer term it belongs in the grav_ynh package so it doesnt get wiped on upgrade, worth filing on the github app repo.