mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not allow direct download of .inc files (unparsed PHP source). Fixes #8005

Browse Source
This commit is contained in:
jim-p 2017-10-25 14:33:34 -04:00
parent e48ae6f294
commit b1fccd4254
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/etc/inc/system.inc
View File

@ -1532,7 +1532,10 @@ EOD;
location / {
index index.php index.html index.htm;
}
location ~ \.inc$ {
deny all;
return 403;
}
location ~ \.php$ {
try_files \$uri =404; # This line closes a potential security hole
# ensuring users can't execute uploaded files