[4.0] Block access to uploaded error-\d.html files

[dhensby]

See #113

This opens a risk of users uploading error-*.html files and having them presented by the site as legitimate pages which could be used for nefarious purposes.

This needs preventing.

[tractorcow]

+1... will get around to this.

[tractorcow]

Um, I can't seem to be able to do this without blocking ErrorDocument in the root .htaccess from working. If we make these files non-web accessible, we can't use apache to serve errors directly anymore.

[tractorcow]

I found another issue in the template evaluation at silverstripe/silverstripe-framework#6061

[sminnee]

Best fix here is probably to save these somewhere other than the assets/ folder, e.g. somewhere outside of the web root.

[tractorcow]

@sminnee I could fix this by removing ErrorDocument, and documenting how to add it back again. However, it would break the ability for apache to handle errors natively (which, in practice, I never really see done. Error handling is done by PHP). Would this be an acceptable fix?

[dhensby]

👍