Commit f0a9fc96 authored by Dom Sekotill's avatar Dom Sekotill
Browse files

Prevent missing files in media from calling the PHP controller

parent efeae4ab

data/nginx.conf

+4 −2
Original line number Diff line number Diff line
@@ -94,10 +94,12 @@ server { 
		}

	}



	# limit the usefulness of malicious HTML/JS hosted in /media/ by serving 

	# only media & common data files with their correct mime-type

	# Limit the usefulness of malicious HTML/JS hosted in /media/ by serving

	# only media & common data files with their correct mime-type.

	# Don't allow missing paths to be delegated to the PHP controller.

	location /media/ {

		root /app;

		try_files $uri =404;

		default_type application/octet-stream;

		types {

			# images #