@harrysintonen@infosec.exchange I hadn't thought of that, good point!

Post mortem:

This issue was made possible by a misconfiguration whereas "AllowOverride none" was used by accident. That made it possible to read the configuration file even though .htaccess file preventing it is in place.

So this in part this specific issue was a mistake by the admin (read: myself). I think it still highlights an issue that could occur in many other ways as well. It is best to restrict network access to servers when upgrading them.

PS: If you can't do things right at least make it possible for others to learn from your mistakes. 🙂

@harrysintonen@infosec.exchange That's bonkers

@harrysintonen@infosec.exchange this really shouldn't happen, and I wonder what the exact config here is. In an fpm setup, which I believe is the common thing these days, you would not have your fpm daemon run, and your server returns an error.

@harrysintonen@infosec.exchange my old sysadmin was terrified of this specific problem so years and years ago we amended our php.ini, added a directory to the include_path outside of the website root and agreed that all functional code would live there and only presentation/formatting code would live in the website root.

It was a really solid system but it's made it a real bitch to look for outside hosting to migrate to now that my current sysadmin just doesn't /want/ to maintain a web server anymore.