Please fix Disable PHP in Uploads issue (FIles with PHP in the name are blocked)

Maybe set it to look for the patern “.php” instead of “php”. Not sure if this is a solution, but seems logical.

I am not sure how to write .htaccess rules, but this is abviously where the issue lies…

RewriteRule ^(.*)/uploads/(.*).php(.?) - [F]

But instead of catching .php files its catching php period, the second that those 3 letter are in a files name, its blocked.

Now the rules to protect other files is written a bit differntly:

RewriteRule ^wp-includes/[^/]+\.php$ - [F]

Not sure if that would make a difference.

This is not the best way to do it:

RewriteRule ^(.*)/uploads/(.*).php(.?) - [F]

They’re capturing groups for no reason and not escaping the literal period. You’re having issues because they didn’t escape the literal period before the letters php

This would work more accurately and more efficiently. Though still not ideal, it should work better.

RewriteRule /uploads/.*\.php - [F]

Why did I remove this?
^(.*)

And this?
(.?)

That’s because it does the same thing with or without them. So why waste time parsing them in the first place?

One thing that I must mention is that the code that is provided by the plugin or the alternative I provided above, does not disable PHP execution like they state. It only prevents access to any of those files via HTTP. There is a big difference.

If you wanted to disable the execution you would need to add a handler. This would be easier using a separate .htaccess file in your uploads directory. But using the same methodology that the plugin provides, you could do something like this to actually disable PHP execution in your uploads directory.

Options -ExecCGI
RewriteRule /uploads/.*\.php - [H=cgi-script,NC,L]

First you set it so that any files treated as a cgi script will not be able to execute
Options -ExecCGI

Then you set the RewriteRule:
RewriteRule /uploads/.*\.php

Then you set the target:
-

Then you set the flags,
[H=cgi-script,NC,L]
which include the following:
1) H flag, which is the Handler flag and this sets it to cgi-script which will cause it not to be executed with the Options directive set to -ExecCGI
2) NC flag, makes it case insensitive
3) L flag, makes it the last rule.

Now if you’ve done this correctly, when trying to access any php files there it should throw some type of internal server error.

Thanks for the info, I will test these out once I get to my main system where I can test it out.

Regards,
Matt

Works great, my PHP image shows up, and when I access a php file it gives me the 403 error. Now the iThemes Secuity Author needs to implement it in their code.