Merge remote-tracking branch 'tsg/MC-29152' into borg-2.3.5

nathanjosiah · nathanjosiah · commit 935e1f2f8f0a · 2020-01-14T15:36:05.000-06:00
diff --git a/nginx.conf.sample b/nginx.conf.sample
@@ -93,7 +93,7 @@ location / {
 }
 
 location /pub/ {
-    location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
+    location ~ ^/pub/media/(downloadable|customer|import|custom_options|theme_customization/.*\.xml) {
         deny all;
     }
     alias $MAGE_ROOT/pub/;
@@ -166,6 +166,11 @@ location /media/downloadable/ {
 location /media/import/ {
     deny all;
 }
+
+location /media/custom_options/ {
+    deny all;
+}
+
 location /errors/ {
     location ~* \.xml$ {
         deny all;
diff --git a/pub/media/custom_options/.htaccess b/pub/media/custom_options/.htaccess
@@ -0,0 +1,7 @@
+<IfVersion < 2.4>
+    order deny,allow
+    deny from all
+</IfVersion>
+<IfVersion >= 2.4>
+    Require all denied
+</IfVersion>

Original file line number	Diff line number	Diff line change
`@@ -93,7 +93,7 @@ location / {`
`93`	`93`	`}`
`94`	`94`
`95`	`95`	`location /pub/ {`
`96`		`- location ~ ^/pub/media/(downloadable\|customer\|import\|theme_customization/.*\.xml) {`
	`96`	`+ location ~ ^/pub/media/(downloadable\|customer\|import\|custom_options\|theme_customization/.*\.xml) {`
`97`	`97`	`deny all;`
`98`	`98`	`}`
`99`	`99`	`alias $MAGE_ROOT/pub/;`
`@@ -166,6 +166,11 @@ location /media/downloadable/ {`
`166`	`166`	`location /media/import/ {`
`167`	`167`	`deny all;`
`168`	`168`	`}`
	`169`	`+`
	`170`	`+location /media/custom_options/ {`
	`171`	`+ deny all;`
	`172`	`+}`
	`173`	`+`
`169`	`174`	`location /errors/ {`
`170`	`175`	`location ~* \.xml$ {`
`171`	`176`	`deny all;`