summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorcatch2012-09-05 12:53:41 (GMT)
committercatch2012-09-05 12:53:41 (GMT)
commit3c0da100087b599667af56fff6db5d44a22b5254 (patch)
treecbcd781252fa9cfb9e0fa88a50a63a2bd50a6dd6
parenta1bdd9747420a36defcce03ee0597feea61fa545 (diff)
Issue #1760330 by s.Daniel: Fixed Hide vulnerable drupal install.php sites from search engines.
-rw-r--r--core/includes/install.core.inc15
1 files changed, 15 insertions, 0 deletions
diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc
index 1b6c8a3..51e2846 100644
--- a/core/includes/install.core.inc
+++ b/core/includes/install.core.inc
@@ -788,6 +788,21 @@ function install_full_redirect_url($install_state) {
*/
function install_display_output($output, $install_state) {
drupal_page_header();
+
+ // Prevent install.php from being indexed when installed in a sub folder.
+ // robots.txt rules are not read if the site is within domain.com/subfolder
+ // resulting in /subfolder/install.php being found through search engines.
+ // When settings.php is writeable this can be used via an external database
+ // leading a malicious user to gain php access to the server.
+ $noindex_meta_tag = array(
+ '#tag' => 'meta',
+ '#attributes' => array(
+ 'name' => 'robots',
+ 'content' => 'noindex, nofollow',
+ ),
+ );
+ drupal_add_html_head($noindex_meta_tag, 'install_meta_robots');
+
// Only show the task list if there is an active task; otherwise, the page
// request has ended before tasks have even been started, so there is nothing
// meaningful to show.