[2010-07-15] IIS allows access to various PHP scripts that shouldn't be allowed

[silverstripe]

[2010-07-15] IIS allows access to various PHP scripts that shouldn't be allowed

[tractorcow]

In framework all .php files need to be whitelisted.

See https://github.com/silverstripe/silverstripe-framework/blob/3.1/web.config

We should add this to cms as well.

[dhensby]

is this done?

[tractorcow]

No, and this is very easily done. Triaging and assigning to v3.

[chillu]

Now that all core modules are placed in vendor, and vendor access is denied by default, it's only a problem for modules that haven't made the switch to silverstripe-vendormodule yet. It's still an issue for SS3. But overall, it's much lower impact now (now impact/critical)

[sminnee]

I would assume that the fix or this (slated for 4.1) is to move the webroot to a subfolder. As such I think that this bug as covered by #7419 and we can close this.