RainLoop data folder is accessible

websam

When I open the rainloop admin panel I find the following warning:

RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here: https://www.rainloop.net/docs/installation

Could someone help me solve it as I am not getting it, so I know there has to be with .htaccess rules

something like this:


Deny From All



Require all denied


but it is not working for me when I create .htaccess inside the folder /usr/local/lscp/cyberpanel/rainloop/data

CyberPanel

We will take care of this.

jvnadr

This is critical. You have left exposed all the files inside rainloop installation. For example, I can download from https://xxxx:8090/rainloop/data/_data_/_default_/configs/ the file application.ini that has all the details (database password etc.) from rainloop installation. It is a MAJOR security hole! I cannot understand how you have left it for over 15 days (!!!) without any response...

niall

Has this been fixed yet? I'm on Cyberpanel 1.8.2 and the Rainloop Admin panel is showing the same warning.

CyberPanel

This has been fixed, data folder is now out of the document root of rainloop. I think rainloops check it via rewrite file which we don't use to protect the folder.

websam

Hello! the warning still continues for me in a new installation that I did

Notice:
Warning!

RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here: https://www.rainloop.net/docs/installation

--

in the install page of rainloop has the following solution for nginx:

If you are using nginx, add the following to your domain configuration file:

location ^ ~ / data {
   deny all;
}

however, nothing for cyberpanel with litespeed ={

CyberPanel

You will not be able to access data folder it is out of the document root.

herbertserrano

essayservice said:
Hello! the warning still continues for me in a new installation that I did

Notice:
Warning!

RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here: https://www.rainloop.net/docs/installation

--

in the install page of rainloop has the following solution for nginx:

If you are using nginx, add the following to your domain configuration file:

location ^ ~ / data {
   deny all;
}

however, nothing for cyberpanel with litespeed ={

You should know you can't go to a directory outside of the www root.