From b0caa5c68099e6f2f85a0a5e3f82eb5d0bd4922d Mon Sep 17 00:00:00 2001 From: sminnee Date: Tue, 19 Oct 2010 23:00:58 +0000 Subject: [PATCH] BUGFIX: Enhance the protection of the assets/ directory in both IIS and Apache by including a file type whitelist. git-svn-id: svn://svn.silverstripe.com/silverstripe/open/phpinstaller/branches/2.4@112963 467b73ca-7a2a-4603-9d3b-597d59a354a9 --- assets/.htaccess | 35 ++++++++++++++++- assets/web.config | 97 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+), 2 deletions(-) create mode 100644 assets/web.config diff --git a/assets/.htaccess b/assets/.htaccess index ac6412a..f86e6e2 100644 --- a/assets/.htaccess +++ b/assets/.htaccess @@ -1,2 +1,33 @@ -RemoveHandler .php .phtml .php3 .php4 .php5 .inc -RemoveType .php .phtml .php3 .php4 .php5 .inc +# +# Whitelist appropriate assets files. +# Note that you will need to maintain this whitelist yourself if you modify File::$allowed_extensions +# +# If you are not using Apache then you can ignore this file. +# If you are using IIS then you should look at assets/web.config instead. +# +# To add an extension to the list, you need to put another string of the form "ext|" on the +# FilesMatch line, inside the parentheses. +# +# For example, to add *.exe files to list of downloadable assets, change this line: +# +# + Allow from all + + +# We disable PHP via several methods +# Replace the handler with the default plaintext handler +AddHandler default-handler php phtml php3 php4 php5 inc + +# Turn the PHP engine off +php_flag engine off + diff --git a/assets/web.config b/assets/web.config new file mode 100644 index 0000000..df26900 --- /dev/null +++ b/assets/web.config @@ -0,0 +1,97 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file