Security: Deny access to .hg/* via mod_rewrite

Question

My website is a mercurial repository with multiple subrepositories. I need to make sure I\'m denying access to all files in every .hg directory on the server.

For exampl

Answer 1

You always have the possibility to place .htaccess files in these folders and deny all access within the Folder.

I'm assuming you want a solution, where you don't have to put the .htaccess files in every folder and subfolder?

Try the following (assuming you have ssh access to the webserver):

• Change into the DocumentRoot of your site
• create a .htaccess file

Content:

Order deny, allow
Deny from all

• Execute the following command:

  find . -type d -name .hg -exec cp ./.htaccess {} \;

• Afterwards delete the .htaccess file from your document root again

Answer 2

This is much less of a concern if you just keep the repositories outside of your DocumentRoot altogether. You're probably using hgweb or hgwebdir, which don't require the files be inside the DocumentRoot, so don't do it. Put them in /home/hg/repos or something and configure your hgwebdir.conf to look there.

The only reason to have the repos inside the DocumentRoot would be enable the static-http URL form for mercurial, but it's very slow and hgweb is always preferred when it's possible.

Answer 3

If you don't have to use mod_rewrite, then you can just do this:

RedirectMatch 404 /\\.hg(/|$)

(Full disclosure: answer adapted for Mercurial from this question about doing the same thing for Subversion).