Passing Uncontrolled Requests to PHP
Grant
emailgrant at gmail.com
Thu Feb 13 16:44:34 UTC 2014
Does the wiki example mitigate the "Passing Uncontrolled Requests to PHP" risk?
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fastcgi_params;
}
http://wiki.nginx.org/PHPFcgiExample
http://wiki.nginx.org/Pitfalls#Passing_Uncontrolled_Requests_to_PHP
If not, I'd like to update it.
- Grant
More information about the nginx
mailing list