Another Reason to deny PUT

Posted: Tue Sep 21, 2004 1:49 pm

As reported here:
http://isc.sans.org/diary.php?isc=228bfce5af8d06b80afacd1b8d1ffc56
PUT requests are still being used to deface websites. Why take the risk?
You can easily add PUT to the Nuke Sentinel Request Method blocker and/or in your htaccess.

Posted: Tue Sep 21, 2004 2:05 pm

Code:

<Limit PUT>


  Order Allow,Deny


  Deny from all


  Allow from xx.xx.xxx.xxx <-- your ip


</Limit>





<Limit GET POST>


  Order Allow,Deny


  Allow from all


</Limit>

Posted: Tue Sep 21, 2004 3:52 pm

From the linked sec article, placing a restriction on PUT request would deny file uploads, correct? If so, if I have uploading in a module enabled (e.g. photos in coppermine by registered members), and place a PUT request restriction, the uploading (by members) would fail, correct?

Client Joined: Apr 10, 2004 Posts: 649 Location: UK

Would it also affect members uploading their own avatars ?