Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hopefully an easy one for you nginx gurus out there. I can't find any relevant info on google or the docs, but I hope this is possible.

Essentially, using advice gained from others, we want to prevent PHP from running in our public upload directories. We're accomplishing this like so:

if($uri !~ "^/vb_attach/") {
    fastcgi_pass 127.0.0.1:9005;
}

But on this website, we've got multiple upload directories. I know that nginx doesn't support && or || in the conditional, so we tried this:

    if ($uri !~ "^/vb_attach/") {
            if($uri !~ "^/vb_album/") {
                    fastcgi_pass   127.0.0.1:9005;
            }
    }

but were told that the second if wasn't allowed there. So how can we accomplish this? All we want to do is prevent PHP from executing in these upload directories, just in case someone is able to bypass the checks in the upload scripts.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

One best-practice way to do this is with location blocks which refuse requests for PHP files.

For example:

server {
  location /vb_attach {
    location ~ \.php$ {return 403;}
  }

  location /vb_album {
    location ~ \.php$ {return 403;}
  }

  location ~ \.php {
    ...
  }
}

The nginx wiki has several alternatives for preventing this particular security issue which you may find useful in other circumstances as well.

share|improve this answer
    
Thank you! I'd seen some other methods involving setting a variable in the first location check, then concatenating a value in the second location check. Then if variable=AB, pass to FPM. I thought that was really ugly and knew that there had to be a better way. –  Kevin Mar 3 '13 at 2:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.