Bp branch 'block-config' into 'v9.3-2'

images/nginx/config/nginx-server-default.conf

@@ -114,7 +114,12 @@ server {
         fastcgi_pass webdav;
     }
 
+    # We deny access to `.config` due to https://gitlab.cern.ch/webservices/webframeworks-planning/-/issues/927
     # Previously we would deny access to txt/log files, see https://gitlab.cern.ch/webservices/webframeworks-planning/-/issues/853
+    location ~* \.config$ {
+        allow 192.168.0.0/16;
+        deny all;
+    }
 
     # !!! NOTE
     # Order is important in nginx rules. If the following `location` are rearranged, things will BREAK.