silverstripe-installer/web.config
Ingo Schommer 98135df7d3 Prevent YAML access in IIS by default (fixes #8233)
Since SS3 keeps values in configuration, direct access
to known paths might expose them
2013-02-17 21:04:58 +01:00

18 lines
497 B
Plaintext

<configuration>
<system.webServer>
<security>
<requestFiltering>
<hiddenSegments>
<add segment="silverstripe-cache/" />
<add segment="vendor" />
<add segment="composer.json" />
<add segment="composer.lock" />
</hiddenSegments>
<fileExtensions allowUnlisted="true" >
<add fileExtension=".ss" allowed="false"/>
<add fileExtension=".yml" allowed="false"/>
</fileExtensions>
</requestFiltering>
</security>
</system.webServer>
</configuration>