Hi everyone.

I have a question about some folders on my installed Limesurvey server.
I'm running Limesurvey 3.25.4 on Ubuntu 18.04.5.

Our Security Scanner found some folders and settings on my Limesurvey installation and declared them as a security risk.

On my Server there are several subfolder in the folder /tmp/assets with random names like 117445e0 or 49b271bf or db6085.
Can i delete these subfolder? Or will it crash my installation of Limesurvey?

The second question is about "directory listing" on some folders. Can i disable it globally in my webserver configuration or will this lead into an unstable state of my installation.
Folders for example: /test or /docs or /upload

Thanks in advance
Thomas

These assets are not "dangerous", they are created by Limesurvey to not always have to draw from the database, etc. If you delete them, Limesurvey will create them again. so this would be without end.

I'd say this is a false postive.

> Our Security Scanner found some folders and settings on my Limesurvey installation and declared them as a security risk.

Lol

> The second question is about "directory listing" on some folders.

You can remove directoty listing in ALL folders.

If you use apache : we include htaccess with restriction
If you use nginx : see manual


www.limesurvey.org/manual/Installation_security_hints

Hi.

Thanks for you quick responses. I disabled "directory listing" globally and wait for the next scan.
I think the security risk was made by my own

Thomas