5 ms·

The best configuration for a frontloader that I have found so far is: server { server_name domainname.com; root /srv/sites/do

The best configuration for a frontloader that I have found so far is: server { server_name domainname.com; root /srv/sites/domainname.com/httpdocs; index index.php; access_log /srv/sites/domainname.com/logs/access.log main; error_log /srv/sites/domainname.com/logs/error.log info; try_files $uri $uri/ /index.php?$query_string; location ~ \.php$ { try_files $uri $uri/ /index.php?$query_string =403; include /usr/local/nginx/conf/fastcgi_params; fastcgi_pass phpfpm; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } This will allow static files to be served appropriately, standalone .php files to be run, and anything requiring a frontloader to be passed on accordingly. This should work with most frontloader based frameworks, however certain ones will fail, e.g. symphony (no not symfony)... EDIT: Added change suggested by nbpoole to fix security vulnerability.

euroclydon 15y ago
My block has an expires line in there for caching: if (-f $request_filename) { expires 30d; break; } Where would it go in this new scenario?
- elliottcarlson 15y ago
  Personally I handle that with Varnish in front of nginx so not really sure.
- mfjordvald 15y ago
  try_files allow you to use a named location as the final argument as opposed to a file path. This means you can have location /static_files { try_files $uri @fallback; } location @fallback { expires 30d; }
nbpoole 15y ago
That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/ https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an... Edit: You need to copy the try_files line into the PHP location block. I'd recommend using the following line (I just added =403 to the end of yours, so you return a 403 error rather than a 500 error when try_files fails): try_files $uri $uri/ /index.php?$query_string =403;
- k33n 15y ago
  Wow. That's actually really bad. I just patched my php.ini to disallow file uploads because thankfully, we don't need them anyway. Others might not be so lucky though. Also, I'm assuming that by "move try_files" you really mean "copy a variation of try_files". Sorry for being pedantic, and correct me if I'm wrong.
  - nbpoole 15y ago
    Yes, you're right. I actually did move the line in my testing, but for it to work properly, you would want to duplicate it. I'll update my comment. :) I should also mention that merely allowing uploads via php.ini is not an issue: you need to be storing them somewhere web accessible. A good rule of thumb for this: if you could put a PHP script in the uploads directory and have it execute, you have a potential problem.
- elliottcarlson 15y ago
  Thanks - testing and looking in to this now! Edit: In our server setup we use a completely seperate server to handle file upload and serving - which does not run on php-fpm so thankfully this does not affect us - however still going to make appropriate changes and a note that this is a possible issue.

euroclydon 15y ago

My block has an expires line in there for caching: if (-f $request_filename) { expires 30d; break; } Where would it go in this new scenario?

elliottcarlson 15y ago
Personally I handle that with Varnish in front of nginx so not really sure.
mfjordvald 15y ago
try_files allow you to use a named location as the final argument as opposed to a file path. This means you can have location /static_files { try_files $uri @fallback; } location @fallback { expires 30d; }

nbpoole 15y ago

That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/ https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an... Edit: You need to copy the try_files line into the PHP location block. I'd recommend using the following line (I just added =403 to the end of yours, so you return a 403 error rather than a 500 error when try_files fails): try_files $uri $uri/ /index.php?$query_string =403;

k33n 15y ago
Wow. That's actually really bad. I just patched my php.ini to disallow file uploads because thankfully, we don't need them anyway. Others might not be so lucky though. Also, I'm assuming that by "move try_files" you really mean "copy a variation of try_files". Sorry for being pedantic, and correct me if I'm wrong.
- nbpoole 15y ago
  Yes, you're right. I actually did move the line in my testing, but for it to work properly, you would want to duplicate it. I'll update my comment. :) I should also mention that merely allowing uploads via php.ini is not an issue: you need to be storing them somewhere web accessible. A good rule of thumb for this: if you could put a PHP script in the uploads directory and have it execute, you have a potential problem.
elliottcarlson 15y ago
Thanks - testing and looking in to this now! Edit: In our server setup we use a completely seperate server to handle file upload and serving - which does not run on php-fpm so thankfully this does not affect us - however still going to make appropriate changes and a note that this is a possible issue.