Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to know if it's unsecure to leave the .svn folders accessible to anyone on a webserver

eg. : http://yoursite.com/.svn/

if not what's the best way to secure these?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

SVN export is a better answer for most people. Metadata leaks could be problematic in some cases, but if anyone was really surprised by them they didn't read the fine manual and should be scolded. For the rest, I'm using this in .htaccess and it seems to work okay:

## Need to tell apache2 to ignore .svn ... ?
RedirectMatch 403 /\\.svn(/|$)
share|improve this answer
    
thanks is it also working for lighttpd? –  mnml Oct 5 '09 at 23:03
add comment

This has shown to be a security hole, and hackers have been able to view the source of some sites this way.

Typically for sites in a production environment you should use a svn export instead of a checkout.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.