login community faq

I'm trying to serve the static files from a Wordpress installation and I'm using a symbolic link placed in the NGINX folder pointing to the wp-content/uploads folder.

Every file is being served correctly, but unfortunately there are some plugins that include some of their .php files inside this folder, so NGINX serve them as static files, leading to potential security risks.

Is there any way to instruct NGINX to return a Forbidden 403 error when trying to access .php files?

Thanks in advance.

asked Sep 20 '11 at 13:23

zlapper's gravatar image

zlapper
32


You can't make Nginx return a 403 for those files.

Instead, you can use a second symlink app to serve those PHP files via Apache.

For example, if you have some PHP file at /home/zlapper/webapps/wp/wp-content/uploads/someplugin/whatever.php you can do this:

  1. Create a new symlink app, using 'Symbolic link to static/cgi/php app' as the app type and "/home/zlapper/webapps/wp/wp-content/uploads/someplugin" as the symlink path
  2. Add that app to your site with "/wp-content/uploads/someplugin" as the URL path.

That way, requests for http://yourdomain.com/wp-content/uploads/someplugin/whatever.php will be served by Apache and have the PHP processed normally, so Nginx won't serve the PHP as a static file.

Hope that helps!

answered Sep 20 '11 at 15:44

seanf's gravatar image

seanf ♦♦
56441220

thanks a lot, that works! :)

(Sep 20 '11 at 16:50) zlapper zlapper's gravatar image
Your answer
If you have an answer to the above question, then use the form below. Otherwise, use the appropriate 'add new comment' button above to post your feedback.
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Tags:

×127
×19
×7

Asked: Sep 20 '11 at 13:23

Seen: 1,624 times

Last updated: Sep 20 '11 at 16:50

Plans & prices    Sign up    Why WebFaction?    Contact us    Affiliate program    Support    Legal    Jobs    Blog    Control panel login
Powered by OSQA
© Copyright 2003-2012 Swarma Limited - WebFaction is a service of Swarma Limited