Access to Memory (AtoM)

First discovered via the AtoM User Forum, 2019-02-05: https://groups.google.com/d/msg/ica-atom-users/XN-IRUUhzM0/AU7Slrz-FgAJ

Currently, a public user cannot access the web installer pages in AtoM. However, since AtoM supplies a valid webpage (which includes a custom "permission denied" message), bots and curl requests to these restricted pages still return an HTTP 200 status code. We should instead consider returning a 403(forbidden) code in these cases.

To reproduce

• use cURL to try to access the web installer for a site to which you have access to the Nginx access logs - e.g.:

curl http://10.10.10.10/index.php/sfInstallPlugin/configureDatabase

• Now access the Nginx access logs for the site:

sudo tail -f /var/log/nginx/access.log

Resulting error

The curl request returns a 200 status. This is because a webpage is successfully served (though it says access denied)

Expected result

The curl request should return a 403 status.