Very rusty with PHP and Apache so hopefully this will be an easy question. The Apache Wiki has a page on setting up PHP-FPM with Apache 2.4, but the specified ProxyPassMatch method of forwarding requests for .php files to the php-fpm module is insecure. Is there a standard/canonical setup that is secure?
Asked
Active
Viewed 852 times
1
bgibson
- 17,379
- 8
- 29
- 45
1 Answers
3
It's not insecure anymore. There's a new config parameter for php-fpm (since 5.3.9), security.limit_extensions, that defaults to '.php' so php-fpm will only run files with these extensions. It won't run the .jpg in that example.
troseman
- 1,842
- 20
- 19