Should I disallow access to certain roundcube directories in nginx? I'm especially concerned about arbitrary PHP execution in the user upload directory
any directory containing user uploads has execution disabled by definition
Apache:
<IfModule mod_php5.c> php_flag engine off </IfModule>
any directory only containing libraries and no directly accessed files has access denied by definition
that is completly independent of roundcube or whatever webserver that are best practices in any case and not a question
Apache: <IfModule !mod_version.c> Order deny,allow Deny from all
</IfModule> <IfModule mod_version.c> <IfVersion < 2.4> Order deny,allow Deny from all </IfVersion> <IfVersion >= 2.4> Require all denied </IfVersion> </IfModule>
Are the default permissions you reference set via .htaccess files?
- Grant