From c3df9b6484eb2eca4d4074005cb2c81619857402 Mon Sep 17 00:00:00 2001
From: Matias Griese <matias@trilbymedia.com>
Date: Thu, 29 Oct 2020 11:03:28 +0200
Subject: [PATCH] Added `.htaccess` rule to block attempts to use Twig in the
 request URL

---
 .htaccess                      | 3 +++
 CHANGELOG.md                   | 1 +
 webserver-configs/htaccess.txt | 3 +++
 3 files changed, 7 insertions(+)

diff --git a/.htaccess b/.htaccess
index ef79a4bc2..83063ae2e 100644
--- a/.htaccess
+++ b/.htaccess
@@ -27,6 +27,9 @@ RewriteEngine On
 # If you experience problems on your site block out the operations listed below
 # This attempts to block the most common type of exploit `attempts` to Grav
 #
+# Block out any script trying to use twig tags in URL.
+RewriteCond %{REQUEST_URI} ({{|}}|{%|%}) [OR]
+RewriteCond %{QUERY_STRING} ({{|}}|{%25|%25}) [OR]
 # Block out any script trying to base64_encode data within the URL.
 RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
 # Block out any script that includes a <script> tag in URL.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8098bb631..46f3c8dd5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 
 1. [](#bugfix)
     * Fixed hardcoded system folder in blueprints, config and language streams
+    * Added `.htaccess` rule to block attempts to use Twig in the request URL
 
 # v1.6.28
 ## 10/07/2020
diff --git a/webserver-configs/htaccess.txt b/webserver-configs/htaccess.txt
index ef79a4bc2..83063ae2e 100644
--- a/webserver-configs/htaccess.txt
+++ b/webserver-configs/htaccess.txt
@@ -27,6 +27,9 @@ RewriteEngine On
 # If you experience problems on your site block out the operations listed below
 # This attempts to block the most common type of exploit `attempts` to Grav
 #
+# Block out any script trying to use twig tags in URL.
+RewriteCond %{REQUEST_URI} ({{|}}|{%|%}) [OR]
+RewriteCond %{QUERY_STRING} ({{|}}|{%25|%25}) [OR]
 # Block out any script trying to base64_encode data within the URL.
 RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
 # Block out any script that includes a <script> tag in URL.