From 26efcfd66aa2632e8f0b9532b557f65538593702 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Wed, 28 May 2014 09:19:29 -0400 Subject: [PATCH] Feature request 1528: Documentation refers to .htaccess files that have been removed Signed-off-by: Isaac Bennetch --- doc/setup.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/setup.rst b/doc/setup.rst index e8a098c21b..b94235b001 100644 --- a/doc/setup.rst +++ b/doc/setup.rst @@ -224,11 +224,11 @@ options which the setup script does not provide. a login dialog if using :term:`HTTP` or cookie authentication mode. #. You should deny access to the ``./libraries`` and ``./setup/lib`` - subfolders in your webserver configuration. For Apache you can use - supplied :term:`.htaccess` file in that folder, for other webservers, you should - configure this yourself. Such configuration prevents from possible + subfolders in your webserver configuration. + Such configuration prevents from possible path exposure and cross side scripting vulnerabilities that might - happen to be found in that code. + happen to be found in that code. For the Apache webserver, this is + often accomplished with a :term:`.htaccess` file in those directories. #. It is generally a good idea to protect a public phpMyAdmin installation against access by robots as they usually can not do anything good there. You can do this using ``robots.txt`` file in root of your