Webtrees: stop serving data/ and the source folders directly

Caddy served all of /opt/webtrees through file_server, so media under data/media could be fetched by URL without passing webtrees' privacy rules. webtrees only protects data/ with an .htaccess, which Caddy ignores. Deny the folders webtrees' own nginx guide keeps private, plus dotfiles. update_script adds the rule to existing Caddyfiles on every update, not only when a new release is out, and keeps the old file if the result fails caddy validate.
2026-10-06 16:01:11 -04:00 · 2026-10-06 16:06:54 +02:00
1 changed files with 1 additions and 11 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -565,19 +565,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))

-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
-
 ### 💾 Core

-  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
+  - Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
 - Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
 - Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
 - Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))