From f3d1b0d08cf0de406e13b0d7f26b9be1f6c239ef Mon Sep 17 00:00:00 2001
From: Ingo Schommer <ingo@silverstripe.com>
Date: Thu, 9 Dec 2010 22:52:31 +0000
Subject: [PATCH] BUGFIX Disallow web access to cms/silverstripe_version to
 avoid information leakage (from r114770)

git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/cms/branches/2.3@114772 467b73ca-7a2a-4603-9d3b-597d59a354a9
---
 .htaccess  |  7 +++++--
 web.config | 11 +++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 web.config

diff --git a/.htaccess b/.htaccess
index e03b4650..81e3ed4a 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,3 +1,6 @@
-<Files *.php>
+<FilesMatch "\.(php|php3|php4|php5|phtml|inc)$">
 	Deny from all
-</Files>
\ No newline at end of file
+</FilesMatch>
+<FilesMatch "silverstripe_version$">
+	Deny from all
+</FilesMatch>
\ No newline at end of file
diff --git a/web.config b/web.config
new file mode 100644
index 00000000..0e3d0aad
--- /dev/null
+++ b/web.config
@@ -0,0 +1,11 @@
+<configuration>
+	<system.webServer>
+		<security>
+			<requestFiltering>
+				<hiddenSegments>
+					<add segment="silverstripe_version" />
+				</hiddenSegments>
+			</requestFiltering>
+		</security>
+	</system.webServer>
+</configuration>
\ No newline at end of file