3 ms·

> If you're hosting it without apache (as in: without htaccess support), make sure the logs directory and files aren't exposed publicly. Never expose any l

> ~~If you're hosting it without apache (as in: without htaccess support),~~ make sure the logs directory and files aren't exposed publicly. Never expose any logs to strangers for anything anywhere

AndroTux 3y ago
Sure, that’s always sound advice. However, most projects are usually designed in a way that their logs are either not exposed at all (due to not being in the webroot for example), or have measurements in place to avoid exposing them (like WordPress for example). Roundcube just puts them there and you have to actively think about excluding them from your webserver configuration. Plus, they dump really sensitive information in there by default. That’s why I wanted to explicitly point it out in this case.
- crtasm 3y ago
  Can you configure Roundcube to store them outside the webroot?
  - iggldiggl 3y ago
    If you're running Roundcube on its own subdomain, you just set the webroot to the "public_html" subfolder and then nothing else is accessible.