Welcome! Log In Create A New Profile

Advanced

Re: Possible widespread PHP configuration issue - security risk

August 27, 2010 03:12PM
Initial testing shows:

cgi.fix_pathinfo = 0

and Igor's suggestion:

location ~ ^(?<script>.+\.php)(?<path_info>.*)$ {
   fastcgi_pass 127.0.0.1:11000;
   fastcgi_param   SCRIPT_FILENAME  $document_root$script;
   fastcgi_param   PATH_INFO        $path_info;
   include fastcgi_params;
}

To be working properly. I need to check out PATH_INFO using old style
and new style, make sure it still reports the expected behavior for
PHP scripts (PATH_INFO, PHP_SELF, all that jazz)

The one thing I don't like is now I have to hardcode that into each
place, unless I defined the fastcgi_pass location, and then just had a
php.conf - then all of this could be done with a single line of config
code.

set $fastcgi_pass = '127.0.0.1:11000';
include php.conf;

php.conf would have this:

location ~ ^(?<script>.+\.php)(?<path_info>.*)$ {
   fastcgi_pass $fastcgi_pass;
   fastcgi_param   SCRIPT_FILENAME  $document_root$script;
   fastcgi_param   PATH_INFO        $path_info;
   include fastcgi_params;
}

Would that be a workable solution Igor? Prior to this new style of PHP
handling I used to only need two lines:

fastcgi_pass 127.0.0.1:11000;
include fastcgi_params;

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx
Subject Author Posted

Re: Possible widespread PHP configuration issue - security risk

Adam Younce August 27, 2010 02:04PM

Re: Possible widespread PHP configuration issue - security risk

mike August 27, 2010 02:10PM

Re: Possible widespread PHP configuration issue - security risk

Igor Sysoev August 27, 2010 02:44PM

Re: Possible widespread PHP configuration issue - security risk

mike August 27, 2010 02:48PM

Re: Possible widespread PHP configuration issue - security risk

Igor Sysoev August 27, 2010 02:58PM

Re: Possible widespread PHP configuration issue - security risk

mike August 27, 2010 03:12PM

Re: Possible widespread PHP configuration issue - security risk

Ed W August 28, 2010 06:18AM

Re: Possible widespread PHP configuration issue - security risk

mike August 28, 2010 08:28AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 318
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready