Fix for uploads directory code execution doesn't work
-
Overall this is a great plugin, but I have one small criticism: your recommended fix to prevent code execution for uploaded files won’t work under common default Apache/PHP configurations.
Your recommended fix allows requests only for files ending with certain whitelisted extensions:
Order deny,allow Deny from all <Files ~ ".(jpe?g|png|gif|mp3|wav|ogg|m4a|mp4|mov|wmv|avi|mpg|ogv|3gp|3g2|pdf|docx?|pptx?|ppsx?|odt|xlsx?|zip)$"> Allow from all </Files>The problem is that Apache out of the box processes *multiple* file extensions and passes off execution to any handlers registered for them. (The default Apache PHP config also allows execution for multiple file extensions.)
So, even with the above directive in place, PHP code in a file called “evil.php.png” will still execute under common default configurations.
(See https://httpd.apache.org/docs/2.2/mod/mod_mime.html#multipleext)
The solution is probably something like this (I haven’t tested it):
<Files *> SetHandler default-handler </Files>as described here: https://stackoverflow.com/questions/18932756/disable-all-cgi-php-perl-for-a-directory-using-htaccess
- The topic ‘Fix for uploads directory code execution doesn't work’ is closed to new replies.
