Need for web.config

[prashants]

Need for web.config

[prashants]

Can you test this web.config and let me know if it works. I dont have access to IIS

http://codeigniter.com/forums/viewthread/91954/#815352

[NewLion]

I have tested it and it works. That is, I've verified it using IIS URL Rewrite. Not sure of its use. Can you please explain it. FYI, the index.php/admin/status pages shows the following warnings:

Security Risk ! The application config directory "config/" is world readable.
Security Risk ! The application accounts directory "config/accounts/" is world readable.
Security Risk ! The users directory "config/users/" is world readable.
Security Risk ! The application settings directory "config/settings/" is world readable.
Security Risk ! The application backup directory "backups/" is world readable.

The above warnings still show after I have included two additional web.config for ./config and ./backups as subsitute for.htaccess deny from all in those directories:

Testing, i.e., browsing to ./backup or ./config throw the 401 error.

[prashants]

It checks the file permission. You can ignore it since its mostly applicable for Linux based machines.

[NewLion]

OK, good. So, in total there are now three web.config (root, root/config and root/backups). I am assuming all the other directories do not require any web.config or access restrictions. If so, lets close this issue as well.

[prashants]

I can use the same web.config in both the folder ? Just confirming because I will not be able to test it.

[prashants]

Fixed the bug. You can do

$git pull
$git checkout v1.x

Note that in checkout command it is v1.x

Or else download the latest version by clicking the below link.
https://github.com/prashants/webzash/zipball/v1.x

[NewLion]

What bug fixes are included in this checkout ?

Yes, both ./config and ./backups contain the same web.config

[prashants]

https://github.com/prashants/webzash/commits/v1.x

the top two feb 04 and feb 08

you can save your changes to a different branch and merge them on top of my changes when needed

[prashants]

fixed the insert statement issue at few places, added the web.config and fixed the closing balance issue

[prashants]

is it possible to add these rules to the web.config file in the root folder ?

[prashants]

can you please check if adding this rule to the main web.config file solves the problem

<rule name="Protect files and directories" stopProcessing="true">
    <match url="^(config|backups)$" />
        <action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Access is forbidden." />
</rule>

[NewLion]

Ok, I will test out your rule in web.config and let you know.

[prashants]

Please let me know whether the above web.config changes will work. I could not get access to a IIS machine. Thanks.

[NewLion]

Sorry for not getting back to you. Got busy with other stuff. Will check and let you know soon.