security bug with how PHP is added as an Apache handler

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The conf.d/php.conf file attaches .php files to its handler like this:
AddHandler php5-script .php

however, that allows some hackery.
for example, create three files, "test.php", "test.php." and "test.php.blahblah". in each, place "<?php phpinfo();" and load them in your browser - they are all rendered as PHP files.

This means that a web application which allows people to upload files (images, for example), but not PHP scripts, can be circumvented by naming the script somescript.php.notphp and then uploading it.

To solve this, it is probably better to change the handler attachment to this:
|<FilesMatch \.php$>
SetHandler php5-script
</FilesMatch> |


kae

_______________________________________________
Fedora-php-devel-list mailing list
Fedora-php-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-php-devel-list

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Fedora KDE]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]

  Powered by Linux