Grav: Disable direct access to .MD files via .htaccess

[flaviocopes]

And all other files that should not be exposed from the site root folder

[rhukster]

Fixed via https://github.com/getgrav/grav/commit/aa60d9f53d889eac543874e9a812d4b9f190b8e8

[flaviocopes]

If you give me the ok, I'll add the same for

• .dependencies
• .editorconfig
• .gitignore
• composer.json
• composer.lock
• LICENSE
• nginx.conf
• web.config

[rhukster]

I guess its not a bad idea to have those blocked too. So yup :)

[Sitethief]

Apache warns against (over)use of modrewrit: https://httpd.apache.org/docs/2.4/rewrite/avoid.html
You should use RedirectMatch, for example like this:

## Begin - Security
# Block all direct access for these folders
RedirectMatch 404 (.git|tests|.AbiSuite|nbproject|.idea)
# Block access to specific file types for these system folders
RedirectMatch 404 (vendor)/(.*)\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat|dist|json|exe)
# Block all direct access to .md files:
RedirectMatch 404 \.md
# Block access to specific files in the root folder
RedirectMatch 404 (composer.lock|composer.json|\.htaccess|LICENSE)
## End - Security

[flaviocopes]

It's a good suggestion, however it poses another requirement for Grav on mod_alias, which might be an issue, or not.