Problem
I'm trying to deny access to two files in my web root, update.php, install.php and require authentication for apc.php (also webroot).
I think I've successfully denied access but on opening the file it's downloaded instead of being run.
For example after entering my authentication for IPADDRESS/apc.php it downloads to my computer instead of opening. The same thing happens for update.php.
If I remove the blocks referencing those three files, it works successfully but of course then they're not blocked. How can I fix this?
So Far
(I've rearranged to bring the relevant chunks to the top.)
I think the problem is this:
The only location match I can get to work is ^~, all others are ignored (why?), and the expression ^~ stops searching after matching and so I think it never finds the PHP chunk. So it downloads instead of running.
I tried adding the php config to the block giving:
location ^~ /update.php {
allow 127.0.0.1;
deny all;
fastcgi_param SCRIPT_FILENAME /srv/www/mysite/public$fastcgi_script_name;
fastcgi_pass 127.0.0.1:9000;
include /etc/nginx/fastcgi_params;
}
But this just causes the page to become blank.
Server Config
server {
listen 8080;
server_name website website.com;
access_log /srv/www/website/logs/access.log;
error_log /srv/www/website/logs/error.log;
root /srv/www/website/public;
location / {
index index.php index.html index.htm;
error_page 404 = @drupal;
}
##deny access to update and install for everyone except the server
location ^~ /update.php {
allow 127.0.0.1;
deny all;
}
location ^~ /install.php {
allow 127.0.0.1;
deny all;
}
##authentication required to access apc.php
location ^~ /apc.php {
auth_basic "Restricted access"; #realm
auth_basic_user_file /srv/www/website/public/.htpasswd-users;
}
##drupal rewrite rules
location @drupal {
rewrite ^(.*)$ /index.php?q=$1 last;
}
##secure private file directory
location ~* /privatefiles {
internal;
}
##Add headers to advagg
location ~* files/advagg_(?:css|js)/ {
access_log off;
expires max;
add_header ETag "";
add_header Cache-Control "max-age=290304000, no-transform, public";
add_header Last-Modified "Wed, 20 Jan 1988 04:20:42 GMT";
try_files $uri @drupal;
}
## Replicate the Apache <FilesMatch> directive of Drupal standard
## .htaccess. Disable access to any code files. Return a 404 to curtail
## information disclosure. Hide also the text files.
location ~* ^(?:.+\.(?:htaccess|make|txt|log|engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
return 404;
}
location ~ \..*/.*\.php$ {
return 403;
}
##rules for running php
location ~ \.php$ {
try_files $uri =404;
include /etc/nginx/fastcgi_params;
if ($uri !~ "^/default/files/") {
fastcgi_pass 127.0.0.1:9000;
}
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /srv/www/website/public$fastcgi_script_name;
}
}