Re: [CentOS] php config security concern for c5

2009-11-18 Thread Kai Schaetzl
Joe Pruett wrote on Wed, 18 Nov 2009 09:39:30 -0800 (PST): > i think that directory context is not just , and the text at > the url says the directive may be placed in , > , or > which i assume means as well. Right. I was getting the German version of this page and I swear it didn't include

Re: [CentOS] php config security concern for c5

2009-11-18 Thread Joe Pruett
>> what in the docs are you reading to indicate forcetype won't work? > > http://httpd.apache.org/docs/2.2/mod/core.html#forcetype > says it works only if given in directory-type context and that's unlikely to > happen here. You would rather set the FilesMatch global. i think that directory contex

Re: [CentOS] php config security concern for c5

2009-11-17 Thread Jim Perrin
> i have reported this upstream.  hopefully they will see it as a problem > and address it. For those of you who are interested, the upstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=537535 Please comment as appropriate. -- During times of universal deceit, telling the truth becomes

Re: [CentOS] php config security concern for c5

2009-11-17 Thread Kai Schaetzl
Joe Pruett wrote on Mon, 16 Nov 2009 08:43:41 -0800 (PST): > what in the docs are you reading to indicate forcetype won't work? http://httpd.apache.org/docs/2.2/mod/core.html#forcetype says it works only if given in directory-type context and that's unlikely to happen here. You would rather set

Re: [CentOS] php config security concern for c5

2009-11-16 Thread Joe Pruett
>> I had both of these on my server, and just now replaced them with >> similar sections. > > Just a comment about the FilesMatch thing. The proposed additional > ForceType will not work in there according to the httpd docs. Not that > this makes a big difference. what in the docs are you reading

Re: [CentOS] php config security concern for c5

2009-11-16 Thread Joe Pruett
>> a recent post on bugtraq hilighted an issue with how upstream has >> configured apache to invoke php, namely using addhandler, which has the >> behavior of matching the extension anywhere in the file. this means >> that foo.php.jpg will be run as php. where this becomes an issue is web >> apps

Re: [CentOS] php config security concern for c5

2009-11-15 Thread Kai Schaetzl
John R Pierce wrote on Sun, 15 Nov 2009 12:26:08 -0800: > I had both of these on my server, and just now replaced them with > similar sections. Just a comment about the FilesMatch thing. The proposed additional ForceType will not work in there according to the httpd docs. Not that this makes

Re: [CentOS] php config security concern for c5

2009-11-15 Thread John R Pierce
Joe Pruett wrote: > a fix is to replace two lines in /etc/httpd/conf.d/php.conf: > > AddHandler php5-script .php > AddType text/html .php > what about other AddHandlers ? for instance, AddHandler cgi-script .cgi AddHandler type-map var I had both of these on my server, and just

Re: [CentOS] php config security concern for c5

2009-11-15 Thread Drew
> a recent post on bugtraq hilighted an issue with how upstream has > configured apache to invoke php, namely using addhandler, which has the > behavior of matching the extension anywhere in the file. this means > that foo.php.jpg will be run as php. where this becomes an issue is web > apps that

[CentOS] php config security concern for c5

2009-11-13 Thread Joe Pruett
a recent post on bugtraq hilighted an issue with how upstream has configured apache to invoke php, namely using addhandler, which has the behavior of matching the extension anywhere in the file. this means that foo.php.jpg will be run as php. where this becomes an issue is web apps that allow