Simple Invoices - Forum

I installed Simple Invoices on a Linux Debian server running Apache 2.2. As documented in the installation procedure, I extracted the installation package to the document root and made the tmp directory writable to the Apache process.

However, I just realized today that without proper configuration, Apache can expose on the internet confidential files located in that tmp sub directory, such as the databases backups containing all your invoicing information and your client list. Although I did not test it, I also think the config/config.ini file was not protected.

I'm not an Apache expert but to prevent this, I used the following configuration :

DocumentRoot /var/www/invoices.mycompany.xyz

<Directory />
   Options FollowSymLinks
   AllowOverride None
</Directory>

<Directory /var/www/invoices.mycompany.xyz>
   Options Indexes FollowSymLinks MultiViews
   AllowOverride None
   Order Allow,Deny
   Allow from all
</Directory>

<DirectoryMatch "^/var/www/invoices.mycompany.xyz/.+/">
   Order Deny,Allow
   Deny from all
</DirectoryMatch>

<DirectoryMatch "^/var/www/invoices.mycompany.xyz/(images|templates|include|library)/">
   Order Deny,Allow
   Allow from all
</DirectoryMatch>


This only allow access to the root directory and the images and templates sub directories.

I hope this can help.