Hide the image directories with .htaccess #1268

New Issue

OVERLORD · 2026-02-05T00:27:18+03:00

OVERLORD commented

2026-02-05 00:27:18 +03:00

Originally created by @davidtessier on GitHub (Jul 23, 2019).

Originally assigned to: @ssddanbrown on GitHub.

Describe the bug
The way the .htaccess file is now, if a user inspects an image, and learns its URL path, they can easily remove the image name from the URL path, and then they will see the image directory and have access to click on any picture they otherwise might not have access to.

Steps To Reproduce
Steps to reproduce the behaviour:

Using your browser, inspect any image associated with a page to learn its URL.
Remove the image name from the end of the URL
You should see the image directory.

Expected behaviour
I don't believe users should be able to see the list of files in the directories.

Screenshots

People can currently see the image directory

After adding in -Indexes to the Options line in .htaccess

Possible solution?
Add -Indexes to the .htaccess file. Direct URL paths to image names still work, but users don't have access to see the list of file names.

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews 
    </IfModule>

    Options -Indexes

    RewriteEngine On

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)/$ /$1 [L,R=301]

    # Handle Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

Your Configuration (please complete the following information):

BookStack v0.26.3
PHP Version: 7.2.19
Apache 2.4.29
Ubuntu 18.04

Originally created by @davidtessier on GitHub (Jul 23, 2019). Originally assigned to: @ssddanbrown on GitHub. **Describe the bug** The way the [.htaccess](https://github.com/BookStackApp/BookStack/blob/master/public/.htaccess) file is now, if a user inspects an image, and learns its URL path, they can easily remove the image name from the URL path, and then they will see the image directory and have access to click on any picture they otherwise might not have access to. **Steps To Reproduce** Steps to reproduce the behaviour: 1. Using your browser, inspect any image associated with a page to learn its URL. 2. Remove the image name from the end of the URL 3. You should see the image directory. **Expected behaviour** I don't believe users should be able to see the list of files in the directories. **Screenshots** **People can currently see the image directory** ![2019-07-23 12_31_20-Index of _uploads_images_gallery_2019-07](https://user-images.githubusercontent.com/1824441/61730176-dbe45100-ad46-11e9-910b-9fe0402136ab.png) **After adding in `-Indexes` to the Options line in .htaccess** ![2019-07-23 12_46_26-403 Forbidden](https://user-images.githubusercontent.com/1824441/61730708-efdc8280-ad47-11e9-8c7a-0e4fc55d8cf9.png) **Possible solution?** Add -Indexes to the[ .htaccess](https://github.com/BookStackApp/BookStack/blob/master/public/.htaccess) file. Direct URL paths to image names still work, but users don't have access to see the list of file names. ``` <IfModule mod_rewrite.c> <IfModule mod_negotiation.c> Options -MultiViews </IfModule> Options -Indexes RewriteEngine On # Redirect Trailing Slashes If Not A Folder... RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)/$ /$1 [L,R=301] # Handle Front Controller... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L] </IfModule> ``` **Your Configuration (please complete the following information):** - BookStack v0.26.3 - PHP Version: 7.2.19 - Apache 2.4.29 - Ubuntu 18.04

OVERLORD added the 🚀 Priority 🔒 Security labels 2026-02-05 00:27:18 +03:00

OVERLORD closed this issue

2026-02-05 00:27:21 +03:00

OVERLORD commented

2026-02-05 00:27:25 +03:00

@ssddanbrown commented on GitHub (Aug 3, 2019):

Thanks for raising @davidtessier, Totally agree.

To be honest, I thought that indexes were currently hidden by realised that's only the behaviour of our install scripts, not the supplied .htaccess files themselves. Have marked for next release so it's not forgotten.

@ssddanbrown commented on GitHub (Aug 3, 2019): Thanks for raising @davidtessier, Totally agree. To be honest, I thought that indexes were currently hidden by realised that's only the behaviour of our install scripts, not the supplied `.htaccess` files themselves. Have marked for next release so it's not forgotten.

OVERLORD commented

2026-02-05 00:27:29 +03:00

@ssddanbrown commented on GitHub (Aug 7, 2019):

I have just deployed v0.26.4 which includes rules to prevent indexes for apache instances that read htaccess files.

@ssddanbrown commented on GitHub (Aug 7, 2019): I have just deployed [v0.26.4](https://github.com/BookStackApp/BookStack/releases/tag/v0.26.4) which includes rules to prevent indexes for apache instances that read htaccess files.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#1268