fix: address code review — Apache 2.4 htaccess, browseDir traversal, SQL cast

- Update .htaccess content to support both Apache 2.4 (Require all denied) and Apache 2.2 (Order deny,allow) in all four locations - Guard browseDir parent navigation to prevent escaping allowed boundaries - Add explicit (int) cast on viewLog SQL query for defense-in-depth
2026-06-07 09:17:20 -05:00
parent e72a007041
commit 41b481dbfe
5 changed files with 17 additions and 6 deletions
@@ -198,7 +198,7 @@ class Pkg_MokoJoomBackupInstallerScript
 				mkdir($backupDir, 0755, true);

 				// Protect backup directory with .htaccess
-				file_put_contents($backupDir . '/.htaccess', "Order deny,allow\nDeny from all\n");
+				file_put_contents($backupDir . '/.htaccess', "# Apache 2.4+\n<IfModule mod_authz_core.c>\n  Require all denied\n</IfModule>\n# Apache 2.2\n<IfModule !mod_authz_core.c>\n  Order deny,allow\n  Deny from all\n</IfModule>\n");
 				file_put_contents($backupDir . '/index.html', '<!DOCTYPE html><title></title>');
 			}
 		}