potential security risk of readme example configuration
kdurov opened this issue · 1 comments
kdurov commented
location /theme {
alias /srv/www/fileserver/theme;
}
is a exploitable configuration as hackers could access unrelated files within /srv/www/fileserver/ directory via https://[host]/themeWHATEVER , albeit unlikely do files named themeWHATEVER exist.
It's a good practice to add trailing slashes to both location and alias to prevent path traversal and this potential risk.
location /theme/ {
alias /srv/www/fileserver/theme/;
}