Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

copr: backend: execute PHP only for dir-generator.php

Browse source
This commit is contained in:
Pavel Raiskup 2021-02-02 19:30:03 +01:00
parent 55528ea6ba
commit 8ba5a4889f
1 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

19
roles/copr/backend/templates/lighttpd/lighttpd.conf
View file

@ -88,8 +88,6 @@ server.modules = (
{% endif %} {% endif %}
) )
cgi.assign = ( ".php" => "/usr/bin/php-cgi" )
## ##
####################################################################### #######################################################################
@ -309,9 +307,26 @@ server.max-keep-alive-idle = 2
## index-file.names = ( "index.php", "index.rb", "index.html", ## index-file.names = ( "index.php", "index.rb", "index.html",
## "index.htm", "default.htm" ) ## "index.htm", "default.htm" )
## ##
# Warning: This is sooo ugly.
#
# We only ever want to enable PHP CGI for the index generator file
# 'dir-generator.phpj, nothing else - so people can not execute their own
# scripts. IOW, non-conditional 'cgi.assign' can not be used!
#
# To make 'index-file.names' work correctly, we have to set 'cg.assign'
# conditionally only on paths that both (a) end by slash (= directories) and
# (b) do not contain 'dir-generator' string. This guards against
# '/some/dir-generator.php/' hacks.
index-file.names = ( index-file.names = (
"/dir-generator.php" "/dir-generator.php"
) )
$HTTP["url"] =~ "/$" {
$HTTP["url"] !~ "dir-generator" {
cgi.assign = ( "/dir-generator.php" => "/usr/bin/php-cgi" )
}
}
## ##
## deny access the file-extensions ## deny access the file-extensions