When I open the rainloop admin panel I find the following warning:
RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here: https://www.rainloop.net/docs/installation
Could someone help me solve it as I am not getting it, so I know there has to be with .htaccess rules
something like this:
<Location “/usr/local/lscp/cyberpanel/rainloop/data”>
Deny From All
<Directory “/usr/local/lscp/cyberpanel/rainloop/data”>
Require all denied
but it is not working for me when I create .htaccess inside the folder /usr/local/lscp/cyberpanel/rainloop/data
This is critical. You have left exposed all the files inside rainloop installation. For example, I can download from https://xxxx:8090/rainloop/data/_data_/_default_/configs/ the file application.ini that has all the details (database password etc.) from rainloop installation. It is a MAJOR security hole! I cannot understand how you have left it for over 15 days (!!!) without any response…
This has been fixed, data folder is now out of the document root of rainloop. I think rainloops check it via rewrite file which we don’t use to protect the folder.
essayservice said:
Hello! the warning still continues for me in a new installation that I did
Notice:
Warning!
RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here: https://www.rainloop.net/docs/installation
–
in the install page of rainloop has the following solution for nginx:
If you are using nginx, add the following to your domain configuration file:
location ^ ~ / data {
deny all;
}
however, nothing for cyberpanel with litespeed ={
You should know you can’t go to a directory outside of the www root.
If it’s fixed and Rainloop keeps showing the warning, how can we let Rainloop know it’s all under control? Where is the document root located? Why not simply add an .htaccess rule there?
If it’s fixed and Rainloop keeps showing the warning, how can we let Rainloop know it’s all under control? Where is the document root located? Why not simply add an .htaccess rule there?
The root config files are located here:
/usr/local/lscp/cyberpanel/rainloop/data
Hi, have error in rainloop.
RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. How to fix it? Thanks