保护Apache和PHP-FPM

Question

Given

ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9000/var/www/$1

how can one prevent malicious code execution when a fake image is uploaded in a folder which is then called via

http://www.foo.bar/uploads/malicious.jpg/fake.php

If I understand correctly, the request above will let Apache pass it to PHP-FPM which will execute /uploads/malicious.jpg.

I know I could add an .htaccess file in the uploads folder that removes the ProxyPassMatch, but this is something my customers don't know and they could end up being compromised.

Answer 1

There's a new setting in php-fpm since php 5.3.9, 'security.limit_extensions', that limits which files php-fpm will execute. The default is '.php', so the 'malicious.jpg' would not be executed.