38 lines
1.5 KiB
Plaintext
38 lines
1.5 KiB
Plaintext
# Nginx Configuration for Vikon Module Security
|
|
#
|
|
# These rules are ALREADY APPLIED in:
|
|
# - _docker/nginx/local/conf.d/nginx.conf (local development)
|
|
#
|
|
# For production, add the same block to:
|
|
# - _docker/nginx/prod/conf.d/nginx.conf
|
|
# - _docker/nginx/test/conf.d/nginx.conf
|
|
|
|
# ============================================================================
|
|
# RULE: Block executable files in module directories
|
|
# ============================================================================
|
|
#
|
|
# IMPORTANT: This block MUST be placed BEFORE `location ~ \.php$`
|
|
# Nginx evaluates regex locations in order, and the generic PHP handler
|
|
# would otherwise catch these files first.
|
|
#
|
|
# Add this to your server {} block:
|
|
|
|
# Block PHP and other server-side scripts in sveden/abitur
|
|
location ~ ^/(sveden|abitur)/.*\.(php|php3|php4|php5|php7|php8|phps|phtml|pl|py|pyc|cgi|sh|bash|bat|cmd|exe|com|ps1|psm1|rb|asp|aspx|jsp|cfm)$ {
|
|
deny all;
|
|
return 403;
|
|
access_log /var/log/nginx/blocked_module_scripts.log;
|
|
}
|
|
|
|
# ============================================================================
|
|
# TESTING
|
|
# ============================================================================
|
|
#
|
|
# After adding the rule:
|
|
# 1. Restart Docker: docker compose restart nginx
|
|
# 2. Test blocked: curl -I http://localhost/sveden/test.php (should return 403)
|
|
# 3. Test allowed: curl -I http://localhost/sveden/index.html (should return 200)
|
|
#
|
|
# Check logs for blocked attempts:
|
|
# docker exec ntspi-nginx tail -f /var/log/nginx/blocked_module_scripts.log
|