The conf.d/php.conf file attaches .php files to its handler like this:
AddHandler php5-script .php
however, that allows some hackery.
for example, create three files, "test.php", "test.php." and
"test.php.blahblah". in each, place "<?php phpinfo();" and load them in
your browser - they are all rendered as PHP files.
This means that a web application which allows people to upload files
(images, for example), but not PHP scripts, can be circumvented by
naming the script somescript.php.notphp and then uploading it.
To solve this, it is probably better to change the handler attachment to
this:
|<FilesMatch \.php$>
SetHandler php5-script
</FilesMatch> |
kae
