Skip to content

[FIX] Storage Folder Security #691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devhammed wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[FIX] Storage Folder Security #691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/variations/fpm-apache/etc/apache2/conf-available/security.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains

# Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
# Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
<LocationMatch "^/storage/.*\.php$">
<LocationMatch "^/storage/.*\.php(?:/|$)">
Require all denied
</LocationMatch>

Expand All @@ -80,4 +80,4 @@ Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains
<Files xmlrpc.php>
Require all denied
# allow from xxx.xxx.xxx.xxx
</Files>
</Files>
8 changes: 4 additions & 4 deletions src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ absolute_redirect off;
# Healthcheck: Set /healthcheck to be the static health check URL
location /healthcheck {
access_log off;

# set max 5 seconds for healthcheck
fastcgi_read_timeout 5s;

Expand All @@ -32,7 +32,7 @@ location / {

# Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
# Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
location ~* ^/storage/.*\.php$ {
location ~* ^/storage/.*\.php(?:/|$) {
deny all;
}

Expand All @@ -42,10 +42,10 @@ location ~ \.php$ {
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE;
fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME;
}

# additional config
include /etc/nginx/server-opts.d/*.conf;
include /etc/nginx/server-opts.d/*.conf;
8 changes: 4 additions & 4 deletions src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ absolute_redirect off;
# Healthcheck: Set /healthcheck to be the static health check URL
location /healthcheck {
access_log off;

# set max 5 seconds for healthcheck
fastcgi_read_timeout 5s;

Expand All @@ -38,7 +38,7 @@ location / {

# Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
# Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
location ~* ^/storage/.*\.php$ {
location ~* ^/storage/.*\.php(?:/|$) {
deny all;
}

Expand All @@ -48,10 +48,10 @@ location ~ \.php$ {
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE;
fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME;
}

# additional config
include /etc/nginx/server-opts.d/*.conf;
include /etc/nginx/server-opts.d/*.conf;
4 changes: 2 additions & 2 deletions src/variations/frankenphp/etc/frankenphp/Caddyfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ fd00::/8 \
file_server

import performance
import security
import security

{$CADDY_SERVER_EXTRA_DIRECTIVES}
}
Expand Down Expand Up @@ -140,7 +140,7 @@ fd00::/8 \

# Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
# Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
@storage-php path_regexp ^/storage/.*\.php$
@storage-php path_regexp ^/storage/.*\.php(?:/|$)
respond @storage-php 403

# Block access to files that may expose sensitive information
Expand Down