Commit 1048a1f2 authored by Dom Sekotill's avatar Dom Sekotill
Browse files

Block arbitrary *.php requests from reaching the PHP server

parent ee48b69f

Dockerfile

+1 −0
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ ARG nginx_version=latest 
FROM nginx:${nginx_version} as nginx

LABEL uk.org.kodo.maintainer = "Dom Sekotill <dom.sekotill@kodo.org.uk>"

COPY data/nginx.conf /etc/nginx/conf.d/default.conf

COPY data/fastcgi.nginx.conf /etc/nginx/fastcgi_params

COPY data/5*.html /app/html/

data/fastcgi.nginx.conf

0 → 100644
+24 −0
Original line number Diff line number Diff line 
fastcgi_param  QUERY_STRING       $query_string;

fastcgi_param  REQUEST_METHOD     $request_method;

fastcgi_param  CONTENT_TYPE       $content_type;

fastcgi_param  CONTENT_LENGTH     $content_length;



fastcgi_param  SCRIPT_FILENAME    /app$fastcgi_script_name;

fastcgi_param  REQUEST_URI        $request_uri;

fastcgi_param  DOCUMENT_URI       $document_uri;

fastcgi_param  DOCUMENT_ROOT      /app;

fastcgi_param  SERVER_PROTOCOL    $server_protocol;

fastcgi_param  REQUEST_SCHEME     $http_x_forwarded_proto;

fastcgi_param  HTTPS              $forwarded_https;



fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;

fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;



fastcgi_param  REMOTE_ADDR        $remote_addr;

fastcgi_param  REMOTE_PORT        $remote_port;

fastcgi_param  SERVER_NAME        $server_name;

fastcgi_param  SERVER_ADDR        $http_x_forwarded_host;

fastcgi_param  SERVER_PORT        $http_x_forwarded_port;



# PHP only, required if PHP was built with --enable-force-cgi-redirect

fastcgi_param  REDIRECT_STATUS    200;

data/nginx.conf

+12 −32
Original line number Diff line number Diff line
@@ -32,16 +32,10 @@ server { 
		internal;

	}



	location ~ \.php$ {

	location /index.php {

		include fastcgi_params;

		fastcgi_param SCRIPT_FILENAME /app$fastcgi_script_name;

		fastcgi_param DOCUMENT_ROOT /app;

		fastcgi_param REQUEST_SCHEME $http_x_forwarded_proto;

		fastcgi_param HTTPS $forwarded_https;

		fastcgi_param SERVER_ADDR $http_x_forwarded_host;

		fastcgi_param SERVER_PORT $http_x_forwarded_port;

		add_header X-Clacks-Overhead "GNU Terry Pratchett";

		fastcgi_pass upstream:9000;

		add_header X-Clacks-Overhead "GNU Terry Pratchett";

	}



	location = /.probe {
@@ -65,16 +59,6 @@ server { 
		try_files $uri =404;

	}



	# block the XMLRPC script

	location = /xmlrpc.php {

		return 404;

	}



	# block external cron triggers

	location = /wp-cron.php {

		return 404;

	}



	# allow the new JSON REST API

	location /wp-json/ {

		rewrite ^ /index.php$is_args$args last;
@@ -86,27 +70,23 @@ server { 
		try_files $uri /index.php$is_args$args;

	}



	location = /wp-login.php {

		include fastcgi_params;

		fastcgi_pass upstream:9000;

		add_header X-Clacks-Overhead "GNU Terry Pratchett";

	}



	# wp-admin uses lots of directly accessed PHP scripts, unfortunately

	location = /admin/ {

		rewrite ^ /wp-admin/ permanent;

	}

	location /wp-admin/ {

		try_files $uri $uri/index.php;

	}



	# serve only static files from wp-includes

	location ^~ /wp-includes/ {

		# don't serve PHP source code from wp-includes

		location ~ \.php {

			return 404;

		}

	}



	# serve only static files from wp-content

	location ^~ /wp-content/ {

		# don't serve PHP source code from plugins, etc

		location ~ \.php {

			return 404;

		location ~ \.php$ {

			include fastcgi_params;

			fastcgi_pass upstream:9000;

			add_header X-Clacks-Overhead "GNU Terry Pratchett";

		}

	}