Block direct image downloads for private wikis

[chef.git] / cookbooks / mediawiki / templates / default / apache.erb

diff --git a/cookbooks/mediawiki/templates/default/apache.erb b/cookbooks/mediawiki/templates/default/apache.erb
index 40e206d1bbb9ae0c16e9ec2f0de5a4432ef46fd6..b37ec1b0c898f6aeadaa49ad2aa9cda391370ad1 100644 (file)
--- a/cookbooks/mediawiki/templates/default/apache.erb
+++ b/cookbooks/mediawiki/templates/default/apache.erb
@@ -48,6 +48,9 @@
 
   <Directory <%= @directory %>>
     Options -Indexes
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all granted
+<% end -%>
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/images/>
@@ -55,6 +58,15 @@
     php_admin_flag engine off
     Options -ExecCGI -Includes -Indexes
     AllowOverride None
+    AddType text/plain .html .htm .shtml
+<% if @mediawiki[:private] -%>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
+    Order allow,deny
+    Deny from all
+<% end -%>
+<% end -%>
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/images/thumb/>
@@ -78,22 +90,23 @@
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/maintenance/>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Directory>
 
   <Files <%= @mediawiki[:directory] %>/LocalSettings.php>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Files>
 
-  <Directory <%= @mediawiki[:directory] %>/images/>
-    Options -ExecCGI -Includes -Indexes
-    AllowOverride None
-    AddType text/plain .html .htm .shtml
-    php_admin_flag engine off
-  </Directory>
-
   <Directory <%= @mediawiki[:directory] %>/cache/>
     Options -ExecCGI -Includes -Indexes
     AllowOverride None
@@ -102,18 +115,30 @@
   </Directory>
 
   <Directory ~ "\.svn">
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Directory>
 
   <Directory ~ "\.git">
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Directory>
 
   <Files ~ "~$">
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Files>
 </VirtualHost>
 <% if @mediawiki[:enable_ssl] -%>
@@ -167,6 +192,9 @@
 
   <Directory <%= @directory %>>
     Options -Indexes
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all granted
+<% end -%>
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/images/>
@@ -174,6 +202,14 @@
     php_admin_flag engine off
     Options -ExecCGI -Includes -Indexes
     AllowOverride None
+<% if @mediawiki[:private] -%>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
+    Order allow,deny
+    Deny from all
+<% end -%>
+<% end -%>
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/images/thumb/>
@@ -189,13 +225,21 @@
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/maintenance/>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Directory>
 
   <Files <%= @mediawiki[:directory] %>/LocalSettings.php>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Files>
 
   <Directory <%= @mediawiki[:directory] %>/images/>
@@ -213,18 +257,30 @@
   </Directory>
 
   <Directory ~ "\.svn">
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Directory>
 
   <Directory ~ "\.git">
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Directory>
 
   <Files ~ "~$">
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
     Order allow,deny
     Deny from all
+<% end -%>
   </Files>
 </VirtualHost>
 <% end -%>