Extend the scope of webserver protected folders

[michalkleiner]

Description:

As per the title, ref. DEV-18936

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[michalkleiner]

key->value items in the array have string keys, without the pair the key is numeric, so we can use this to check if we have some additions or not.

[michalkleiner]

There is an explicit .htaccess in misc/cron allowing access to the archive.php script, so this should be ok as an extended scope.

[michalkleiner]

This is the content of the /misc folder web.config after the change, before the change the is no web.config file in the /misc folder.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <denyUrlSequences>
          <add sequence=".php" />
        </denyUrlSequences>
        <alwaysAllowedUrls>
          <add url="/misc/cron/archive.php" />
        </alwaysAllowedUrls>
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

[michalkleiner]

The generation can be tested using the ddev local env if you comment out the if (!SettingsServer::isIIS()) { condition in ServerFilesGenerator::createWebConfigFiles method, then it generates the web.config files as well when running ./console core:create-security-files command.