Say my website allows users to create directories as well as upload to a directory called "/uploads", like so:
/uploads/user_created_folder_1
/uploads/user_created_folder_2
/uploads/user_created_folder_3
... so on and so forth
How do I prevent any potentially malicious script from being executed in "/uploads" as well as all of its subdirectories?
Is the following code in the server block correct?
location /uploads/.*.(php|pl|py|jsp|asp|sh|cgi)$ {
return 403;
error_page 403 403.html;
}
Thanks very much!