groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-06-28 13:31:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Block access to all php and phar files that are uploaded into the media folder

Browse source
This commit is contained in:
Jan Böhmer 2026-06-07 20:40:15 +02:00
parent c2ec0ee12b
commit 6e5d1c967f
5 changed files with 29 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.docker/symfony.conf
View file

@ -15,6 +15,14 @@
AllowOverride All
</Directory>
# Prevent PHP execution in the media upload directory (server-level, not .htaccess,
# because public/media is a Docker volume and .htaccess there may not be present)
<Directory /var/www/html/public/media>
<FilesMatch "(?i)\.(php[3-8]?|phar|phtml|pht|phps)$">
Require all denied
</FilesMatch>
</Directory>
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular