Skip to content

Commit 1f7c026

Browse files
jaapmarcusAlexandros Ioannides
jaapmarcus
and
Alexandros Ioannides
authored
Update nginx templates as php files where still executable (hestiacp#2338)
* Update Wordpress * Update Drupal-Composer * Update Drupal-Social * Update Drupal * Update Joomla * Update Moodle * Update Thunder In all cases prevent execution of .php files Co-authored-by: Alexandros Ioannides <alex@focus-net.net>
1 parent 7ad3d40 commit 1f7c026

File tree

14 files changed

+115
-114
lines changed

14 files changed

+115
-114
lines changed

‎install/deb/templates/web/nginx/php-fpm/drupal-composer.stpl‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,11 @@ server {
3030
access_log off;
3131
}
3232

33-
location ~ \..*/.*\.php$ {
34-
deny all;
35-
return 404;
36-
}
37-
3833
location ~ ^/sites/.*/private/ {
3934
deny all;
4035
return 404;
4136
}
4237

43-
location ~ ^/sites/[^/]+/files/.*\.php$ {
44-
deny all;
45-
return 404;
46-
}
47-
4838
location ~ /\.(?!well-known\/) {
4939
deny all;
5040
return 404;
@@ -57,7 +47,17 @@ server {
5747
expires 30d;
5848
fastcgi_hide_header "Set-Cookie";
5949
}
60-
50+
51+
location ~ \..*/.*\.php$ {
52+
deny all;
53+
return 404;
54+
}
55+
56+
location ~ ^/sites/[^/]+/files/.*\.php$ {
57+
deny all;
58+
return 404;
59+
}
60+
6161
location ~ [^/]\.php(/|$)|^/update.php {
6262
fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
6363
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

‎install/deb/templates/web/nginx/php-fpm/drupal-composer.tpl‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,20 +25,11 @@ server {
2525
access_log off;
2626
}
2727

28-
location ~ \..*/.*\.php$ {
29-
deny all;
30-
return 404;
31-
}
32-
3328
location ~ ^/sites/.*/private/ {
3429
deny all;
3530
return 404;
3631
}
3732

38-
location ~ ^/sites/[^/]+/files/.*\.php$ {
39-
deny all;
40-
return 404;
41-
}
4233

4334
location ~ /\.(?!well-known\/) {
4435
deny all;
@@ -53,6 +44,16 @@ server {
5344
expires 30d;
5445
fastcgi_hide_header "Set-Cookie";
5546
}
47+
48+
location ~ \..*/.*\.php$ {
49+
deny all;
50+
return 404;
51+
}
52+
53+
location ~ ^/sites/[^/]+/files/.*\.php$ {
54+
deny all;
55+
return 404;
56+
}
5657

5758
location ~ [^/]\.php(/|$)|^/update.php {
5859
fastcgi_split_path_info ^(.+?\.php)(|/.*)$;

‎install/deb/templates/web/nginx/php-fpm/drupal-social.stpl‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,11 @@ server {
3030
access_log off;
3131
}
3232

33-
location ~ \..*/.*\.php$ {
34-
deny all;
35-
return 404;
36-
}
37-
3833
location ~ ^/sites/.*/private/ {
3934
deny all;
4035
return 404;
4136
}
4237

43-
location ~ ^/sites/[^/]+/files/.*\.php$ {
44-
deny all;
45-
return 404;
46-
}
47-
4838
location ~ /\.(?!well-known\/) {
4939
deny all;
5040
return 404;
@@ -57,6 +47,16 @@ server {
5747
expires 30d;
5848
fastcgi_hide_header "Set-Cookie";
5949
}
50+
51+
location ~ \..*/.*\.php$ {
52+
deny all;
53+
return 404;
54+
}
55+
56+
location ~ ^/sites/[^/]+/files/.*\.php$ {
57+
deny all;
58+
return 404;
59+
}
6060

6161
location ~ [^/]\.php(/|$)|^/update.php {
6262
fastcgi_split_path_info ^(.+?\.php)(|/.*)$;

‎install/deb/templates/web/nginx/php-fpm/drupal-social.tpl‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,21 +25,11 @@ server {
2525
access_log off;
2626
}
2727

28-
location ~ \..*/.*\.php$ {
29-
deny all;
30-
return 404;
31-
}
32-
3328
location ~ ^/sites/.*/private/ {
3429
deny all;
3530
return 404;
3631
}
3732

38-
location ~ ^/sites/[^/]+/files/.*\.php$ {
39-
deny all;
40-
return 404;
41-
}
42-
4333
location ~ /\.(?!well-known\/) {
4434
deny all;
4535
return 404;
@@ -53,6 +43,16 @@ server {
5343
expires 30d;
5444
fastcgi_hide_header "Set-Cookie";
5545
}
46+
47+
location ~ \..*/.*\.php$ {
48+
deny all;
49+
return 404;
50+
}
51+
52+
location ~ ^/sites/[^/]+/files/.*\.php$ {
53+
deny all;
54+
return 404;
55+
}
5656

5757
location ~ [^/]\.php(/|$)|^/update.php {
5858
fastcgi_split_path_info ^(.+?\.php)(|/.*)$;

‎install/deb/templates/web/nginx/php-fpm/drupal.stpl‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -34,22 +34,12 @@ server {
3434
deny all;
3535
return 404;
3636
}
37-
38-
location ~ \..*/.*\.php$ {
39-
deny all;
40-
return 404;
41-
}
42-
37+
4338
location ~ ^/sites/.*/private/ {
4439
deny all;
4540
return 404;
4641
}
4742

48-
location ~ ^/sites/[^/]+/files/.*\.php$ {
49-
deny all;
50-
return 404;
51-
}
52-
5343
location ~ /vendor/.*\.php$ {
5444
deny all;
5545
return 404;
@@ -67,7 +57,17 @@ server {
6757
expires 30d;
6858
fastcgi_hide_header "Set-Cookie";
6959
}
70-
60+
61+
location ~ \..*/.*\.php$ {
62+
deny all;
63+
return 404;
64+
}
65+
66+
location ~ ^/sites/[^/]+/files/.*\.php$ {
67+
deny all;
68+
return 404;
69+
}
70+
7171
location ~ [^/]\.php(/|$)|^/update.php {
7272
fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
7373
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

‎install/deb/templates/web/nginx/php-fpm/drupal.tpl‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,11 @@ server {
3030
return 404;
3131
}
3232

33-
location ~ \..*/.*\.php$ {
34-
deny all;
35-
return 404;
36-
}
37-
3833
location ~ ^/sites/.*/private/ {
3934
deny all;
4035
return 404;
4136
}
4237

43-
location ~ ^/sites/[^/]+/files/.*\.php$ {
44-
deny all;
45-
return 404;
46-
}
47-
4838
location ~ /vendor/.*\.php$ {
4939
deny all;
5040
return 404;
@@ -63,6 +53,16 @@ server {
6353
expires 30d;
6454
fastcgi_hide_header "Set-Cookie";
6555
}
56+
57+
location ~ \..*/.*\.php$ {
58+
deny all;
59+
return 404;
60+
}
61+
62+
location ~ ^/sites/[^/]+/files/.*\.php$ {
63+
deny all;
64+
return 404;
65+
}
6666

6767
location ~ [^/]\.php(/|$)|^/update.php {
6868
fastcgi_split_path_info ^(.+?\.php)(|/.*)$;

‎install/deb/templates/web/nginx/php-fpm/joomla.stpl‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,18 +34,18 @@ server {
3434
deny all;
3535
return 404;
3636
}
37-
38-
location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
39-
deny all;
40-
return 404;
41-
}
42-
4337
location / {
4438
try_files $uri $uri/ /index.php?$args;
4539
location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|woff2|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|webp|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
4640
expires 30d;
4741
fastcgi_hide_header "Set-Cookie";
4842
}
43+
44+
location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
45+
deny all;
46+
return 404;
47+
}
48+
4949

5050
location ~ [^/]\.php(/|$) {
5151
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

‎install/deb/templates/web/nginx/php-fpm/joomla.tpl‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,17 +30,17 @@ server {
3030
return 404;
3131
}
3232

33-
location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
34-
deny all;
35-
return 404;
36-
}
37-
3833
location / {
3934
try_files $uri $uri/ /index.php?$args;
4035
location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|woff2|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|webp|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
4136
expires 30d;
4237
fastcgi_hide_header "Set-Cookie";
4338
}
39+
40+
location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
41+
deny all;
42+
return 404;
43+
}
4444

4545
location ~ [^/]\.php(/|$) {
4646
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

‎install/deb/templates/web/nginx/php-fpm/moodle.stpl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,6 @@ server {
3737
deny all;
3838
}
3939

40-
location ~ \..*/.*\.php$ {
41-
return 403;
42-
}
43-
4440
# No no for private
4541
location ~ ^/sites/.*/private/ {
4642
return 403;
@@ -51,6 +47,10 @@ server {
5147
expires max;
5248
fastcgi_hide_header "Set-Cookie";
5349
}
50+
51+
location ~ \..*/.*\.php$ {
52+
return 403;
53+
}
5454

5555
location ~ [^/]\.php(/|$) {
5656
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

‎install/deb/templates/web/nginx/php-fpm/moodle.tpl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,6 @@ server {
3333
deny all;
3434
}
3535

36-
location ~ \..*/.*\.php$ {
37-
return 403;
38-
}
39-
4036
# No no for private
4137
location ~ ^/sites/.*/private/ {
4238
return 403;
@@ -47,6 +43,10 @@ server {
4743
expires max;
4844
fastcgi_hide_header "Set-Cookie";
4945
}
46+
47+
location ~ \..*/.*\.php$ {
48+
return 403;
49+
}
5050

5151
location ~ [^/]\.php(/|$) {
5252
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

0 commit comments

Comments
 (0)