I recently ran a magereport.com scan on one of our magento sites and it reported a cacheleak vulnerability.

In my var folder, there is an .htaccess file but it is not activating and the vulnerability is still reported.

I am running the following:

CentOS release 6.3 (Final)
PHP 5.3.3
Apache 2.2.15

Contents of my var/.htaccess folder is:

Order Deny,Allow
Deny from all

Can someone shed some light why I am still able to access folders in my var folder?

  • As far as i can see the .htaccess looks fine. are you actually able to see the contents of the var folder or is just magereport saying you can? – rob3000 Jan 28 '16 at 0:29

while .htaccess is bad in many cases, you can add this in to your apache vhost config:

<LocationMatch ^/(app|downloader|pkginfo|includes|var)/>
    Deny from all

just make sure you pass manual test, open app and var folder in your browser.

also read this: https://stackoverflow.com/questions/11823915/htaccess-not-being-read

| improve this answer | |
  • Thanks so much ... I did add that to my vhost config when this was first noticed. The problem with that solution was no one could add items to their shopping cart. I believe that was due to the sessions being stored on the filesystem in the var folder though. – abtstack Jan 28 '16 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.