1

Background

Under the recommendation of an upload security best practise article, in my htaccess file there is the following snippet:

ForceType application/octet-stream
<FilesMatch "(?i).jpe?g$">
    ForceType image/jpeg
</FilesMatch>
<FilesMatch "(?i).gif$">
    ForceType image/gif
</FilesMatch>
<FilesMatch "(?i).png$">
    ForceType image/png
</FilesMatch>
<FilesMatch "(?i).css$">
    ForceType text/css
</FilesMatch>

This is supposed to prevent people hiding php code within images etc, although I'm afraid I can't find the source for this snippet despite searching my history, it was a while ago

The Problem

This was working as expected on my local development server (XAMPP), but now I've begun setting up on the production server this snippet seems to be forcing PHP files to be downloaded rather than executed

Since the system uses htaccess to route all files through public/index.php, adding a new directive for .php hasn't worked:

<FilesMatch "(?i).php$">
    ForceType application/x-httpd-php
</FilesMatch>

I can seem to figure out a way to stop this happening - what I'm looking for is a way to prevent the files match treating php as an octet stream (and thus downloading it) or an alternative way to prevent scrips masquerading as images from running

Thanks in advance

0
<FilesMatch "(?i).php$">
    ForceType application/x-httpd-php
</FilesMatch>

Instead, try ForceType None to revert to normal mime-type associations. For example:

<FilesMatch "(?i)\.php$">
    ForceType None
</FilesMatch>

Note that you should also escape the dot in the regex to match a literal dot and not any character. (This goes for all your FilesMatch containers as well.)


Your initial "problem" is obviously your first line: ForceType application/octet-stream. Exposing your PHP source code is itself a security risk, so I cannot help but question the credibility of this code? The fact that this "worked" on your local server is probably just down to the way PHP is installed (module, CGI/FastCGI, etc. etc.)

I'm not a security expert, but I fail to see what this is supposed to do on an already correctly configured server?

1
  • From my understanding, it works by forcing the default action of an octet stream so no edge-cases can be missed. Then progressively allows different types of file extensions and enforces how they are handled. The reasoning behind having this is I may not always be the one hosting the site, and it's very plausible in future configurations can change. Assuming perfect configuration isn't a way to maintain security Thank you for the ForceType None though, I didn't realise that existed – Solflux Feb 13 '17 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.