Oliver Betz writes:
>I'd like to read some opinions from different people about this question -
>if you can do some tests on your own servers, please find out what .htaccess
>settings disallow script execution for the uploaded files on your wiki, and
>report here.
Strange that nobody cares.
One of the shared hostings I can test appears to have no way to prevent the
execution of a file.php.txt. They have some custom modified version of
Apache with PHP/FastCGI and "Options -ExecCGI" does nothing,
"SetHandler ...", "AddType ...", "ForceType ..." and other suggested
solutions cause internal server error.
This is indeed a serious concern if a wiki allows uploads from not
completely trusted persons. I would advise to either disable uploads from
not completely trusted editors or upgrade to the most recent version and
configure the $UploadBlocklist array.
On another shared hosting the file.php.txt is not executed but causes
internal server error which means that their default installation has some
problem - the server tries to do something with this file instead of just
serving it as plain text. Your proposed solution for .htaccess works though.
BTW: I asked in the apache user mailing list about "Options -ExecCGI"
and "SetHandler default-handler" but didn't get any reply.
The Apache documentation is excellent but there are a huge number of
configuration options. On a particular installation not every option can
be selected, and not every problem can be reproduced by the other users, and
in that case the other users will not be able to help much. :-)
Petko
_______________________________________________
pmwiki-users mailing list
pmwiki-users@pmichaud.com
http://www.pmichaud.com/mailman/listinfo/pmwiki-users
