I know I can use the php.ini
open_basedir directive to limit the directory trees where files can be opened by PHP.
But in a directory structure such as this:
├── application │ ├── index.php │ └── www ├── logs └── uploads └── malicious.php.jpg
Is there any way to prevent malicious.php.jpg from being evaluated as PHP if it were specified in an
include(), without preventing PHP from reading/writing uploads to/from that directory?
Edit: I should probably specify that I'm interested in a configuration- or permissions-based solution.