. files security fix

fixes #88 changes #50
6 years ago · 1e88625548
parent ea3afc2fd7
commit 1e88625548
1 changed files with 6 additions and 1 deletions
--- a/public/templates/conf/nginxconfig.io/general.conf.html
+++ b/public/templates/conf/nginxconfig.io/general.conf.html
@ -11,10 +11,15 @@ add_header Content-Security-Policy "{{ data.content_security_policy }}" always;<
 add_header Strict-Transport-Security "max-age=31536000{{ isHSTSSubdomains() ? '; includeSubDomains' : '' }}{{ isHSTSPreload() ? '; preload' : '' }}" always;</span>

 # . files
-location ~ /\.(?!well-known) {
+location ^~ /. {
 	deny all;
 }

+# .well-known
+location ^~ /.well-known/ {
+	allow all;
+}
+
 # favicon.ico
 location = /favicon.ico {
 	log_not_found off;<!--