v7.9-a19: * **Misc** Disabled visits to static folder data files. (Alexander #335626)

Author: Hai Zheng

src/file.cls.php

@@ -16,6 +16,68 @@ class File {
 
 	const MARKER = 'LiteSpeed Operator';
 
+	/**
+	 * Whitelist .htaccess seeded into LITESPEED_STATIC_DIR. Anything not explicitly allowed returns 403.
+	 *
+	 * @since 7.9
+	 */
+	const STATIC_DIR_HTACCESS = <<<HTACCESS
+# BEGIN LSCACHE_STATIC_PROTECT
+# DO NOT EDIT — auto-generated by LiteSpeed Cache.
+# Whitelist: only listed root files and folders are publicly readable.
+
+Options -Indexes
+
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+
+    # Block dotfiles (.litespeed_conf.dat, .htaccess, etc.) anywhere in the tree
+    RewriteRule (^|/)\.[^/]+$ - [F,L]
+
+    # Whitelisted root-level public files
+    RewriteRule ^robots\.txt$ - [L]
+
+    # Whitelisted public asset folders
+    RewriteRule ^(css|js|ucss|ccss|lqip|optimax|avatar|localres|crawler)(/|$) - [L]
+
+    # Default deny
+    RewriteRule .* - [F,L]
+</IfModule>
+# END LSCACHE_STATIC_PROTECT
+HTACCESS;
+
+	/**
+	 * Seed .htaccess + robots.txt into LITESPEED_STATIC_DIR if missing
+	 *
+	 * @since 7.9
+	 */
+	public static function ensure_static_protection() {
+		if (!is_dir(LITESPEED_STATIC_DIR)) {
+			return;
+		}
+		$htaccess_path = LITESPEED_STATIC_DIR . '/.htaccess';
+		if (is_file($htaccess_path)) {
+			return;
+		}
+		$bytes = @file_put_contents($htaccess_path, self::STATIC_DIR_HTACCESS, LOCK_EX);
+
+		$robots_path = LITESPEED_STATIC_DIR . '/robots.txt';
+		if (!is_file($robots_path)) {
+			@file_put_contents($robots_path, "User-agent: *\nDisallow: /\n", LOCK_EX);
+		}
+
+		$banner = sprintf(
+			/* translators: %s: full path to the .htaccess file LiteSpeed Cache failed to create. */
+			__('LiteSpeed Cache could not create %s. Sensitive files (configuration backups, debug logs) under this folder may be publicly accessible. Fix the directory permissions to restore protection.', 'litespeed-cache'),
+			'<code>' . esc_html($htaccess_path) . '</code>'
+		);
+		if ($bytes === strlen(self::STATIC_DIR_HTACCESS)) {
+			Admin_Display::dismiss_pin_by_content($banner, Admin_Display::NOTICE_RED, true);
+		} else {
+			Admin_Display::error($banner, false, true);
+		}
+	}
+
 	/**
 	 * Detect if an URL is 404
 	 *
@@ -146,17 +208,17 @@ public static function save( $filename, $data, $mkdir = false, $append = false,
 
 			try {
 				mkdir($folder, 0755, true);
-				// Create robots.txt file to forbid search engine indexes
-				if (!file_exists(LITESPEED_STATIC_DIR . '/robots.txt')) {
-					file_put_contents(LITESPEED_STATIC_DIR . '/robots.txt', "User-agent: *\nDisallow: /\n");
-				}
 			} catch (\ErrorException $ex) {
 				return $silence ? false : sprintf(__('Can not create folder: %1$s. Error: %2$s', 'litespeed-cache'), $folder, $ex->getMessage());
 			}
 
 			restore_error_handler();
 		}
 
+		if (strpos($filename, LITESPEED_STATIC_DIR . '/') === 0) {
+			self::ensure_static_protection();
+		}
+
 		if (!file_exists($filename)) {
 			if (!is_writable($folder)) {
 				return $silence ? false : sprintf(__('Folder is not writable: %s.', 'litespeed-cache'), $folder);