New answers tagged

1

You handle the upload with POST requests to a PHP script which checks the file extension and renames the file You should check the mime type. PHP have mime_content_type function for that. Even if it's possible to fool the mime header and have some code on the metadata of the file, this raises the bar for exploiting your system. If I understand correctly, ...


0

Regarding the location in the file system hierarchy, there is no difference between /videos, and /var/www/html/site/videos, or the like. The issue is what permissions, i.e. the executable bit, the directory and files have, (which you mentioned), and also the user to which they are assigned, e.g., www-admin, nginx, etc. Also, file uploads should be limited ...


3

This is not strictly an Nginx problem, but rather is an issue with old versions of PHP. It has been fixed for quite a long while (I'm not sure exactly what version, but it certainly isn't a concern with PHP 7.0). The answers to this question: https://serverfault.com/q/627903/377662 Explain the underlying issue and solution in detail. The short answer is ...


1

The issue is that most often people configure their PHP block like this: location ~ '\.php' { include fastcgi.conf; include fastcgi_params; fastcgi_param HTTP_PROXY ""; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param QUERY_STRING $...


Top 50 recent answers are included