lucee-docs
lucee-docs copied to clipboard
Update Apache example to use regex match
The example Apache Location directive shown in the lockdown guide can be bypasseed by crafting URL's that contain semi-colons.
So a URL like /;/lucee/admin/server.cfm
would bypass that directive and give access to the Lucee Admin app to request from any IP.
Alternatively, you could use <LocationMatch /lucee>...
instead of using the ~
.
Great input! Thx for pointing that out!!! Just updated also the docs here: https://github.com/lucee/lucee-docs/pull/1345 and https://github.com/lucee/lucee-docs/pull/1346
and also updated the video: https://www.youtube.com/watch?v=Y4zKiOSqFGw