groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-06-27 13:01:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Block access to all php and phar files that are uploaded into the media folder

Browse source
This commit is contained in:
Jan Böhmer 2026-06-07 20:40:15 +02:00
parent c2ec0ee12b
commit 6e5d1c967f
5 changed files with 29 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
public/media/.gitignore vendored
View file

@ -1,3 +1,4 @@
# Ignore everything except this .gitignore
*
!.gitignore
!.gitignore
!.htaccess

10
public/media/.htaccess Normal file
View file

@ -0,0 +1,10 @@
# Deny access to PHP and PHP-like files to prevent remote code execution
<FilesMatch "(?i)\.(php[3-8]?|phar|phtml|pht|phps)$">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</FilesMatch>