[Anigx]

Summary

• Deny both private log directory paths before front-controller routing in the root .htaccess.
• Cover rotated logs (laravel.log.1), backups, nested files, directory requests and nonexistent routes, rather than only filenames ending in .log.
• Add an isolated Apache/PHP regression test using the actual project .htaccess, public/PHP/storage controls and a negative control that rejects image-side protection masking a broken application rule.

Context and scope

Refs LinkStackOrg/linkstack-docker#168.
Related architectural discussion: #935.

The existing .log file restrictions already protect laravel.log when Apache honors .htaccess. On an Apache/PHP baseline built from the Docker repository, the previous project .htaccess nevertheless served an existing laravel.log.1 and a nested text fixture with HTTP 200 over both HTTP and HTTPS. This change hardens those directory boundaries; it does not claim the unrotated log is universally exposed in current installations.

Companion Docker PR: LinkStackOrg/linkstack-docker#169.

The complementary Docker change places log protection outside the persistent application volume. This application change is useful for Apache installations that use the project .htaccess without that image-side protection.

This is not the public-only webroot migration proposed in #935. Nginx/Caddy/IIS require their own server configuration. The exact cause and image/version of the original reporter's deployment are still unverified.

Validation

• Test image built from LinkStackOrg/linkstack-docker revision 50b92be8711b5ed03ea9a675d9cde3409b0c80a8, without the proposed Docker hardening.
• Initial test before adding the rule: 23 checks, 4 failures; the four failing cases returned HTTP 200 with private markers.
• Final expanded test: python3 tests/runtime_logs.py linkstack-log-regression:before — 52 checks; 0 failures.
• Negative control removes only the new rule and requires the rotated log marker to be retrievable, preventing false confidence from an already hardened test image.
• HTTP/HTTPS, rotated/backup/nested files, directory paths with/without trailing slash, nonexistent log routes, query strings, encoded characters, repeated slashes and dot segments.
• Public asset, PHP, public storage and near-prefix (logs-public) controls; unprivileged runtime-log append.
• git diff --check passed.

All log content is synthetic. Test containers have no external network and no published ports. The test does not exercise a complete Laravel installation, the automatic updater, a subdirectory deployment, or arbitrary custom Apache authorization rules.

Deployment

Existing installations must install the updated root .htaccess, including when application files live in a persistent volume. Back up local customizations first. The new rule requires the same Apache rewrite/override support as the application's existing routing rules. No application data or log files are deleted.