0

I'm trying to figure out which method I should use to control script/file execution security.

I'm trying to protect against malicious file upload/execution exploits where a user could potentially upload something bad and then execute it on my website.

What's the best way to protect against this? I only want certain files to be able to execute.

Should I consider taking a whitelist (only allow my files in a directory) or blacklist (based on file extension) approach?

Thanks!

1 Answer 1

1

You would need to post some more details.

When using Nginx for Zend Framework sites, I would whitelist index.php and serve 404 to any other .php file. This is fine for ZF as you only need to call the bootstrap and it handles all the other calls.

When working with a mainly static site, I've whitelisted the handful of PHP files (form processing on a contact form for example) that I know are on there.

On bigger sites which aren't using a bootstrap file, I've blacklisted any PHP files from the directories that are writeable by the Apache process, for example 'image-uploads' 'cache' etc.

I'm afraid the correct solution will depend on how your site is structured.

Why not post some more information?

Andrew

1
  • My site is static. I have a few directories (sub-domains), each with a handful of php scripts and other files (.gif, .jpg, .png, .css, .js). Can you post an example of how you do it? Thanks!
    – Zero
    Oct 31, 2010 at 6:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .