CKFinder 1.x/Developers Guide/PHP/Configuration/Security/Double file extensions - Revision history

Admin: moved CKFinder/Developers Guide/PHP/Configuration/Security/Double file extensions to CKFinder 1.x/Developers Guide/PHP/Configuration/Security/Double file extensions

2010-05-28T06:46:33Z

2008-01-03T10:47:30Z

2008-01-03T10:46:35Z

2008-01-02T08:41:16Z

2008-01-02T08:39:35Z

2007-12-28T13:24:58Z

2007-12-28T13:23:13Z

2007-12-28T11:44:10Z

2007-12-21T14:12:57Z

2007-12-21T12:09:25Z

← Older revision		Revision as of 10:47, 3 January 2008
Line 1:		Line 1:
−	{{Ckfinder Double extensions Description\|code=~~�UNIQ70ba8410fe37519-~~pre~~-00000001-QINU~~}}	+	{{Ckfinder Double extensions Description\|code=<pre>$config['CheckDoubleExtension'] = true ;</pre>}}

← Older revision		Revision as of 10:46, 3 January 2008
Line 1:		Line 1:
−	~~Due to security issues with Apache modules, it is recommended to leave the following setting enabled:~~	+	{{Ckfinder Double extensions Description\|code=�UNIQ70ba8410fe37519-pre-00000001-QINU}}
−	~~<pre>$config['CheckDoubleExtension']~~ = ~~true ;~~
−	</pre>
−	~~How does it work? Suppose the following:~~
−
−	If "php" is on the denied extensions list, a file named foo.php cannot be uploaded. If "rar" (or any other) extension is allowed, one can upload a file named foo.rar. The file foo.php.rar has "rar" extension so, in theory, it can be also uploaded.
−
−	In some conditions Apache can treat the foo.php.rar file just like any PHP script and execute it. If CheckDoubleExtension is enabled, each part of the file name after a dot is checked, not only the last part. In this way, uploading foo.php.rar would be denied, because "php" is on the denied extensions list.

@@ Line 1: / Line 1: @@
-{{Ckfinder Double Extensions|code=
+Due to security issues with Apache modules, it is recommended to leave the following setting enabled:
 <pre>$config['CheckDoubleExtension'] = true&nbsp;;
-</pre>}}
+</pre>

@@ Line 1: / Line 1: @@
-Due to security issues with Apache modules, it is recommended to leave the following setting enabled:
+{{Ckfinder Double Extensions|code=
 <pre>$config['CheckDoubleExtension'] = true&nbsp;;
-</pre>
+</pre>}}

@@ Line 1: / Line 1: @@
 Due to security issues with Apache modules, it is recommended to leave the following setting enabled:
-<pre>config.checkDoubleExtension = true&nbsp;;
+<pre>$config['CheckDoubleExtension'] = true&nbsp;;
 </pre>
 How does it work? Suppose the following:

← Older revision	Revision as of 06:46, 28 May 2010
(No difference)

@@ Line 1: / Line 1: @@
 Due to security issues with Apache modules, it is recommended to leave the following setting enabled:
-<pre>
+<pre>config.checkDoubleExtension = true&nbsp;;
-$config['CheckDoubleExtension'] = true;
+</pre>
-</pre>
+How does it work? Suppose the following:
-If "php" is on the denied extensions list, a file named foo.php cannot be uploaded.
+If "php" is on the denied extensions list, a file named foo.php cannot be uploaded. If "rar" (or any other) extension is allowed, one can upload a file named foo.rar. The file foo.php.rar has "rar" extension so, in theory, it can be also uploaded.
-In some conditions Apache can treat the foo.php.rar file just like any PHP script and execute it.
+In some conditions Apache can treat the foo.php.rar file just like any PHP script and execute it. If CheckDoubleExtension is enabled, each part of the file name after a dot is checked, not only the last part. In this way, uploading foo.php.rar would be denied, because "php" is on the denied extensions list.

← Older revision	Revision as of 11:44, 28 December 2007
(No difference)

← Older revision	Revision as of 14:12, 21 December 2007
(No difference)

← Older revision	Revision as of 12:09, 21 December 2007
(No difference)