Feature #16497
closed
more secure [fileDenyPattern]
0%
Description
I'd like to propose more secure [fileDenyPattern]
\.[php|inc|dhtml|pl|cgi]+$|\.php.$|.*\.[php|phpx|pl|inc|dhtml|pl|cgi]+\..*$|\.htaccess$
Standard pattern is \.php$|\.php.$ and that prevent from:
1) .php
2) *.php4,.php5, etc. -> *.php[any char here]
That of course not all ext that may be executed on server.
The extended (suggested) pattern prevent from all well known script ext as:
a) php
b) inc
c) dhtml
e) pl
f) cgi
additionally it prevents from making double extension like *php.rar, *.inc.rar, etc. See http://forums.deftechgroup.com/archive/index.php/t-1638.html to get information about the problem.
Finally it prevents from uploading .htaccess.
(issue imported from #M4104)
Updated by Krystian Szymukowicz almost 18 years ago
This patter could be even better:
\.[php|inc|dhtml|pl|cgi]+$|\.php.$|.*\.[php|phpx|pl|inc|dhtml|pl|cgi]+\..{1,3}$|\.htaccess$
I added limiter {1,3}.
You can check that pattern in http://weitz.de/regex-coach/.
Updated by Krystian Szymukowicz about 16 years ago
In 4.2.1 it has been changed to
\.php[3-6]?(\..*)?$|^\.htaccess$
and as far as I know it is not going to change anymore so this issue can be closed.
Updated by