View Issue Details

Jump to NotesJump to History
This issue affects 2 person(s).
 262
IDProjectCategoryView StatusDate SubmittedLast Update
17580Bug reportsSecuritypublic2021-09-08 13:022026-09-15 23:37
ReporterMazi Assigned To 
PrioritynoneSeverityminor 
Status closedResolutionno change required 
Product Version3.25.20 
Summary17580: readme and release note are publicly accessible and can reveal version details to attackers
Description

The readme and for some systems the release note details can be accessed publicly (example: https://ls3.my-survey.host/README.md or https://demo.limesurvey.org/docs/release_notes.txt). This could reveal version details to attackers.

Should we extend the .htaccess file to not make these accessible from the web?

TagsNo tags attached.
Bug heat262
Complete LimeSurvey version number (& build)3.22.10+200323
I will donate to the project if issue is resolvedNo
BrowserChrome
Database type & versionMySQL
Server OS (if known)Ubuntu 20
Webserver software & version (if known)Apache
PHP Version7.2.24
Git branch / Pull Request URL

Users monitoring this issue

There are no users monitoring this issue.

Activities

DenisChenu

DenisChenu

2021-09-08 14:58

developer   ~66404

It's false for docs/* (with apache)
https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/.htaccess

Must be added in nginx part for manual https://manual.limesurvey.org/General_FAQ#With_nginx_webserver
And : https://manual.limesurvey.org/Installation_security_hints#Web_server_restriction
c_schmitz

c_schmitz

2021-09-09 08:32

administrator   ~66411

I think you can figure out the major version by just looking at the login and code, so I am not so worried about the README, but I agree that the changelog should be either renamed (maybe *.php with a die()) or removed.
DenisChenu

DenisChenu

2024-09-12 16:47

developer   ~81005

@c_schmitz : maybe we can remove docs/* from zip file via .gitattributes ?

Else for apache : doc reading is disable
For nginx : advice is done

Need a IIS …
Mazi

Mazi

2026-09-15 20:17

updater   ~85765

@c_schmitz, so was this just closed without any modifications?
c_schmitz

c_schmitz

2026-09-15 23:37

administrator   ~85775

There default configuration for Apache blocks it, the example nginx configuration in our documentation blocks it.
I don't think further modifications are needed here.

Issue History

Date Modified Username Field Change
2021-09-08 13:02 Mazi New Issue
2021-09-08 14:58 DenisChenu Note Added: 66404
2021-09-08 14:58 DenisChenu Bug heat 250 => 252
2021-09-09 08:32 c_schmitz Note Added: 66411
2021-09-09 08:32 c_schmitz Bug heat 252 => 254
2021-09-09 08:32 guest Bug heat 254 => 260
2021-09-09 08:36 galads Assigned To => galads
2021-09-09 08:36 galads Status new => confirmed
2024-09-12 16:47 DenisChenu Note Added: 81005
2026-09-15 18:28 c_schmitz Assigned To galads =>
2026-09-15 18:28 c_schmitz Status confirmed => closed
2026-09-15 18:28 c_schmitz Resolution open => no change required
2026-09-15 20:17 Mazi Note Added: 85765
2026-09-15 20:17 Mazi Bug heat 260 => 262
2026-09-15 23:37 c_schmitz Note Added: 85775