Double file extensions

This website contains links to software which is no longer maintained. For the latest documentation about current CKSource projects, including software like CKEditor 4/CKEditor 5, CKFinder 3, Cloud Services, Letters, Accessibility Checker, please visit the new documentation website.

Due to security issues with Apache modules, it is recommended to leave the following setting enabled:

CKFinder_Config.Add "CheckDoubleExtension", True

How does it work? Suppose the following:

If "php" is on the denied extensions list, a file named foo.php cannot be uploaded. If "rar" (or any other) extension is allowed, one can upload a file named foo.rar. The file foo.php.rar has "rar" extension so, in theory, it can be also uploaded.

In some conditions Apache can treat the foo.php.rar file just like any PHP script and execute it. If CheckDoubleExtension is enabled, each part of the file name after a dot is checked, not only the last part. In this way, uploading foo.php.rar would be denied, because "php" is on the denied extensions list.

This page was last edited on 28 May 2010, at 06:46.