Skip to content
Ulrich Berntien edited this page Sep 6, 2020 · 2 revisions

TWA-0401

Message

"SCM repository being served at: ${url}"

In the message output the variable ${url} is replaced by the served URL of the SCM data.

Explanation

To use an SCM (source control management or version control) system to manage the web pages is a good solution. But the web server should not publish the internal website management data.

Files used by the GIT (.git subdirectory), Mercurial (.hg subdirectory) or Subversion (.svn subdirectory) should not be published by the web server.

Current (August 2020) the twa script checks: '.git/HEAD', '.hg/store/00manifest.i' and '.svn/entries'.

Remediation

Configure the web server to not publish the management data.

There exists several configuration options to suppress all dot-files, dot-files on a blacklist or dot-files not on white list. Search the web for examples.

Clone this wiki locally