rosell-dk / htaccess-capability-tester Goto Github PK

In some cases, the location of the .htaccess matters and in some cases, files should not be written to that place.

Ie, in Wordpress, we might want to check capabilities in the plugin folder. But we do not want to write files there because that will cause some security plugins - like Wordfence - to trigger a warning.

In such cases, it will be handy to have use this framework to run test files already placed on the server.

When a test relies on a php in the directory being tested, it implicitly relies on that there is not some configuration which is preventing PHP files from being run in that directory (would be a sensible thing to do in for example a directory which is intended for media files)

There is no proper handling of the cases when a request completely fails (no status code, no nothing). Many of the tests results in failure, where they should result in indeterminate.

1. Redirect to a txt file rather than a php, as that would additionally require phps to be run in that directory
2. A 500 Internal Server Error should be handled as a test failure. This ensures that the test reports failure when the server has been set up to disallow the required directives in the directory. This may in rare situations result in false negatives

Spec:
https://greenbytes.de/tech/webdav/rfc2616.html#message.headers

The library currently treats the field name as case sensitive

• Avoid a "test.php" file
• Only report failure on a 500 Internal Server Error. All other status codes (even server errors) should report success

The composer.json only requires php 5.6 and 7.0 but no 8.0 which causes issue with our pipelines. Please add php 8.0 support