Better nginx configuration example [#1269894]

Just wanted to point out that in your sample nginx configuration you write:

locate ^~ /progress {
   report_uploads uploads;
}

That "locate" should of course be "location".

-----------

Your next bit is a bit unusual and therefore threw me off at first, because you assign fastcgi explicitly to index.php.

location = /index.php {
   include fastcgi.conf;
   fastcgi_pass phpcgi;
   track_uploads uploads 60s;
}

A more typical configuration probably looks something like:

location ~ \.php$ {
  fastcgi_pass unix:/var/run/php5-fpm.sock;
  fastcgi_index index.php;
  include fastcgi_params;
  track_uploads uploads 60s;
}

Comments

Comment #1

ralf.strobel CreditAttribution: ralf.strobel commented 5 September 2011 at 11:03

Title:	Errors in nginx configuration example	» Better nginx configuration example
Priority:	Normal	» Minor

Oh, but after I had figured out these minor problems, your module now works like a charm for us. Thanks a lot for this!

Comment #2

perusio CreditAttribution: perusio commented 20 September 2011 at 22:17

It's not:

assign fastcgi explicitly to index.php.

but rather that your config is unsafe. Instead by using an exact location I'm constraining $fastcgi_script_name to be index.php. Meaning that everything goes through index.php. Therefore any other PHP file must be explicitly allowed through an exact location.

Comment #3

perusio CreditAttribution: perusio commented 20 September 2011 at 22:21

Fixed the typo on the project page. Thanks.

Comment #4

perusio CreditAttribution: perusio commented 20 September 2011 at 22:22

Assigned:	Unassigned	» perusio
Status:	Active	» Fixed

Comment #5

ralf.strobel CreditAttribution: ralf.strobel commented 21 September 2011 at 05:22

Status:

Fixed

» Active

I know what your intention was with the index.php. My point was just that very few people do this, and since this is example code, it'll throw some people off since they don't understand it.

If you want to keep it in like that, at least you should comment on it.

I don't think my configuration is "unsafe", actually. It's the default behavior of most web servers (e.g. Apache + modphp). As a web admin, you should make sure that there are no other script files out there that can be called directly and will do something harmful.

Did you check that in your config, calling a php script other than index.php will not lead to it's code being displayed publicly? If not I could call your settings.php and I see your hash salt and database password.

Comment #6

perusio CreditAttribution: perusio commented 21 September 2011 at 14:05

Nope. You can try it. There's a catch all PHP location right at the end.

## Any other attempt to access PHP files returns a 404.
location ~* ^.+\.php$ {
    return 404;
}

Also check this thread out.

Comment #7

dropbydrop CreditAttribution: dropbydrop commented 13 November 2011 at 12:48

i agree with ralf

Comment #8

perusio CreditAttribution: perusio commented 19 January 2012 at 16:19

The catch all PHP location is unsafe. It's now even listed at the Nginx Wiki Pitfalls page why should we propagate an error?

Just because "everybody does it" doesn't mean that it's acceptable.

Comment #9

perusio CreditAttribution: perusio commented 19 January 2012 at 16:20

Status:

Active

» Closed (won't fix)

Comment #10

ralf.strobel CreditAttribution: ralf.strobel commented 17 March 2012 at 07:08

My point was never that your example code was wrong. My point was that people might not recognize and understand it. You can keep it this way, but you should probably explain it in a comment then and refer back to the code more people will know.