(Template contents proof-read and formatted) |
(Custom title added) |
||
| Line 1: | Line 1: | ||
| + | {{#CUSTOMTITLE:Dealing with Double File Extensions}} | ||
Due to security issues with Apache modules it is recommended to leave the following setting enabled: | Due to security issues with Apache modules it is recommended to leave the following setting enabled: | ||
{{{code}}} | {{{code}}} | ||
| + | |||
How does it work? Suppose the following scenario: | How does it work? Suppose the following scenario: | ||
Revision as of 09:49, 29 March 2011
Due to security issues with Apache modules it is recommended to leave the following setting enabled: {{{code}}}
How does it work? Suppose the following scenario:
If php is added to the denied extensions list, a file named foo.php cannot be uploaded. If rar (or any other) extension is added to the allowed extensions list, one can upload a file named foo.rar. The file foo.php.rar has a rar extension so in theory, it can also be uploaded.
Under some circumstances Apache can treat the foo.php.rar file just like any other PHP script and execute it. If CheckDoubleExtension is enabled, each part of the file name after a dot is checked, not only the last part. In this approach uploading foo.php.rar would be denied, because php can be found on the denied extensions list.