RainLoop data folder is accessible

websam

When I open the rainloop admin panel I find the following warning:

RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here: https://www.rainloop.net/docs/installation

Could someone help me solve it as I am not getting it, so I know there has to be with .htaccess rules

something like this:


Deny From All



Require all denied


but it is not working for me when I create .htaccess inside the folder /usr/local/lscp/cyberpanel/rainloop/data

CyberPanel

We will take care of this.

jvnadr

This is critical. You have left exposed all the files inside rainloop installation. For example, I can download from https://xxxx:8090/rainloop/data/_data_/_default_/configs/ the file application.ini that has all the details (database password etc.) from rainloop installation. It is a MAJOR security hole! I cannot understand how you have left it for over 15 days (!!!) without any response...

niall

Has this been fixed yet? I'm on Cyberpanel 1.8.2 and the Rainloop Admin panel is showing the same warning.

CyberPanel

This has been fixed, data folder is now out of the document root of rainloop. I think rainloops check it via rewrite file which we don't use to protect the folder.