File web.config - Could we delete the file

[ir0nb1t]

Hi,
we have Chamilo 1.11.26 a security analyst report to us that he can access to file web.config (domain-chamilo.com/web.config) and report as information disclosure,
What is the function of the file web.config?
this file can be delete or how can we restrict the access to that file.

[ywarnier]

Yes, you can totally delete this file or restrict access to it. In v1.11.28 (just released) we have added a restriction in the root .htaccess

<Files "web.config">
  Require all denied
</Files>

So that if Chamilo is served by Apache, it will prevent access to this file (which is only used for IIS anyway).