Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to only allow access to my index.php file and block all other php files. However, what works on my windows box is giving me trouble in debian.

# Route all requests for non-existent files to index.php
if (!-e $request_filename) {
    rewrite ^/(.*)$ /index.php/$1 last;
}

# Hide all PHP scripts
location ~ \.php {
    rewrite ^/(.*)$ /index.php/$1 last;
}

# Forward index.php requests to php-fastcgi
location ~ ^/index.php {
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass 127.0.0.1:9000;
}

The goal is to insure that everything comes through the index so no one can load any php class that happen to be web accessible.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You don't need the if check. I also tried to clean up the configuration file a bit to avoid unnecessary captures and directives. I think it should work but it's written free-hand so there might be syntax errors and such.

try_files $uri @missing;

location @missing {
    rewrite ^ /index.php$request_uri last;
}

# This will only run if the below location doesn't, so anything other than /index.php
location ~ \.php {
    rewrite ^ /index.php$request_uri last;
}

# Remove the = if it doesn't match because of the rewrite appending the URI.
location = /index.php {
    include fastcgi.conf; # Notice that I changed the file, 
    fastcgi_pass 127.0.0.1:9000;
}
share|improve this answer
    
That was just what I needed. However, since I'm using Debian I had to install the backports nginx package to get nginx 7 which is required for "try_files". Also, I changed that last location to location ^~ /index.php and it worked. –  Xeoncross Oct 1 '10 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.