Ed W Wrote:
-------------------------------------------------------
> Look, not had a lot of success raising this
> quietly. The Nginx wiki
> has a number of very insecure PHP configuration
> suggestions. Anyone
> using these example configurations should
> immediately review their
> configuration and ensure that they aren't
> vulnerable to an upload attack
> where uploaded files might be accidentally treated
> as executable files
> by nginx
>
More discussion and proposed fixes here: http://forum.nginx.org/read.php?2,88845,88996
In addition to:
1. disabling .php execution in upload directories;
2. adding a try_files to your .php location to check that the requested .php file exists;
you can also change this setting in php.ini
cgi.fix_pathinfo=1
to
cgi.fix_pathinfo=0
to disable that feature and then use
location ~ ^(.+\.php)(.*)$ {
try_files $uri =404;
include /etc/nginx/fastcgi_params;
fastcgi_index index.php;
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass http://localhost:9000;
}
if you have software that needs the path_info feature. The only thing I use that does is chive.
Thanks in advance for updating the wiki