2

Problem

I'm trying to deny access to two files in my web root, update.php, install.php and require authentication for apc.php (also webroot).

I think I've successfully denied access but on opening the file it's downloaded instead of being run.

For example after entering my authentication for IPADDRESS/apc.php it downloads to my computer instead of opening. The same thing happens for update.php.

If I remove the blocks referencing those three files, it works successfully but of course then they're not blocked. How can I fix this?

So Far

(I've rearranged to bring the relevant chunks to the top.)

I think the problem is this:

The only location match I can get to work is ^~, all others are ignored (why?), and the expression ^~ stops searching after matching and so I think it never finds the PHP chunk. So it downloads instead of running.

I tried adding the php config to the block giving:

location ^~ /update.php {
      allow 127.0.0.1;
      deny all;
      fastcgi_param SCRIPT_FILENAME /srv/www/mysite/public$fastcgi_script_name;
      fastcgi_pass 127.0.0.1:9000;
      include /etc/nginx/fastcgi_params;
}

But this just causes the page to become blank.

Server Config

server {
      listen 8080;
        server_name website website.com;
        access_log /srv/www/website/logs/access.log;
        error_log /srv/www/website/logs/error.log;
        root /srv/www/website/public;


        location / {
           index index.php index.html index.htm;
           error_page 404 = @drupal;
        }

        ##deny access to update and install for everyone except the server
        location ^~ /update.php {
            allow 127.0.0.1;
            deny all;
        }

        location ^~ /install.php {
            allow 127.0.0.1;
            deny all;
        }


        ##authentication required to access apc.php
        location ^~ /apc.php {
            auth_basic "Restricted access"; #realm
            auth_basic_user_file /srv/www/website/public/.htpasswd-users;
        }

        ##drupal rewrite rules
        location @drupal {
            rewrite ^(.*)$ /index.php?q=$1 last;
        }

        ##secure private file directory
        location ~* /privatefiles {
             internal;
        }

        ##Add headers to advagg
        location ~* files/advagg_(?:css|js)/ {
            access_log off;
            expires    max;
            add_header ETag "";
            add_header Cache-Control "max-age=290304000, no-transform, public";
            add_header Last-Modified "Wed, 20 Jan 1988 04:20:42 GMT";
            try_files  $uri @drupal;
        }

        ## Replicate the Apache <FilesMatch> directive of Drupal standard
        ## .htaccess. Disable access to any code files. Return a 404 to curtail
        ## information disclosure. Hide also the text files.
        location ~* ^(?:.+\.(?:htaccess|make|txt|log|engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
            return 404;
        }

        location ~ \..*/.*\.php$ {
            return 403;
        }

        ##rules for running php
        location ~ \.php$ {
            try_files $uri =404;
            include /etc/nginx/fastcgi_params;
            if ($uri !~ "^/default/files/") {
                fastcgi_pass 127.0.0.1:9000;
            }
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /srv/www/website/public$fastcgi_script_name;
         }


 }

1 Answer 1

0

May it be that the expression

location ^~ /...

is wrong? Shouldn't it read:

location ~ ^/... 

?

Why do you need a regular expression here?

location /install.php

should be ok.

1
  • I think it's ^~. There's only 4 options in the nginx location docs. But I agree, I thought you could just use /, but when I do it doesn't even block permission and I have no idea why. Nov 28, 2013 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .