3 ms·
That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about
by nbpoole 15y ago
That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/ https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an...
Edit: You need to copy the try_files line into the PHP location block. I'd recommend using the following line (I just added =403 to the end of yours, so you return a 403 error rather than a 500 error when try_files fails):
try_files $uri $uri/ /index.php?$query_string =403;
- k33n 15y agoWow. That's actually really bad. I just patched my php.ini to disallow file uploads because thankfully, we don't need them anyway. Others might not be so lucky though. Also, I'm assuming that by "move try_files" you really mean "copy a variation of try_files". Sorry for being pedantic, and correct me if I'm wrong.
- nbpoole 15y agoYes, you're right. I actually did move the line in my testing, but for it to work properly, you would want to duplicate it. I'll update my comment. :) I should also mention that merely allowing uploads via php.ini is not an issue: you need to be storing them somewhere web accessible. A good rule of thumb for this: if you could put a PHP script in the uploads directory and have it execute, you have a potential problem.
- elliottcarlson 15y agoThanks - testing and looking in to this now! Edit: In our server setup we use a completely seperate server to handle file upload and serving - which does not run on php-fpm so thankfully this does not affect us - however still going to make appropriate changes and a note that this is a possible issue.