Double file extensions"

This website contains links to software which is either no longer maintained or will be supported only until the end of 2019 (CKFinder 2). For the latest documentation about current CKSource projects, including software like CKEditor 4/CKEditor 5, CKFinder 3, Cloud Services, Letters, Accessibility Checker, please visit the new documentation website.

If you look for an information about very old versions of CKEditor, FCKeditor and CKFinder check also the CKEditor forum, which was closed in 2015. If not, please head to StackOverflow for support.

 
(7 intermediate revisions by one other user not shown)
Line 1: Line 1:
−
Due to security issues with Apache modules, it is recommended to leave the following setting enabled:
+
{{Ckfinder Double extensions Description|code=<pre>$config['CheckDoubleExtension'] = true ;</pre>}}
−
<pre>
 
−
$config['CheckDoubleExtension'] = true;  
 
−
</pre>
 
−
How does it work? Suppose the following:
 
−
 
 
−
If "php" is on the denied extensions list, a file named foo.php cannot be uploaded.
 
−
If "rar" (or any other) extension is allowed, one can upload a file named foo.rar.
 
−
The file foo.php.rar has "rar" extension so, in theory, it can be also uploaded.
 
−
 
 
−
In some conditions Apache can treat the foo.php.rar file just like any PHP script and execute it.
 
−
If CheckDoubleExtension is enabled, each part of the file name after a dot is checked, not only the last part. In this way, uploading foo.php.rar would be denied, because "php" is on the denied extensions list.
 

Latest revision as of 07:46, 28 May 2010

Due to security issues with Apache modules, it is recommended to leave the following setting enabled: 

$config['CheckDoubleExtension'] = true ;

How does it work? Suppose the following:

If "php" is on the denied extensions list, a file named foo.php cannot be uploaded. If "rar" (or any other) extension is allowed, one can upload a file named foo.rar. The file foo.php.rar has "rar" extension so, in theory, it can be also uploaded.

In some conditions Apache can treat the foo.php.rar file just like any PHP script and execute it. If CheckDoubleExtension is enabled, each part of the file name after a dot is checked, not only the last part. In this way, uploading foo.php.rar would be denied, because "php" is on the denied extensions list.

Retrieved from "https://docs-old.ckeditor.com/index.php?title=CKFinder_1.x/Developers_Guide/PHP/Configuration/Security/Double_file_extensions&oldid=3545"
This page was last edited on 28 May 2010, at 07:46.