Nginx block access to PHP files

Question

I am trying to only allow access to my index.php file and block all other php files. However, what works on my windows box is giving me trouble in debian.

# Route all requests for non-existent files to index.php
if (!-e $request_filename) {
    rewrite ^/(.*)$ /index.php/$1 last;
}

# Hide all PHP scripts
location ~ \.php {
    rewrite ^/(.*)$ /index.php/$1 last;
}

# Forward index.php requests to php-fastcgi
location ~ ^/index.php {
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass 127.0.0.1:9000;
}

The goal is to insure that everything comes through the index so no one can load any php class that happen to be web accessible.

Answer 1

You don't need the if check. I also tried to clean up the configuration file a bit to avoid unnecessary captures and directives. I think it should work but it's written free-hand so there might be syntax errors and such.

try_files $uri @missing;

location @missing {
    rewrite ^ /index.php$request_uri last;
}

# This will only run if the below location doesn't, so anything other than /index.php
location ~ \.php {
    rewrite ^ /index.php$request_uri last;
}

# Remove the = if it doesn't match because of the rewrite appending the URI.
location = /index.php {
    include fastcgi.conf; # Notice that I changed the file, 
    fastcgi_pass 127.0.0.1:9000;
}