如何安全地从通过PHP在任何服务器上运行被prevent上传的文件？ [英] How to safely prevent uploaded file from being run via PHP on any server?
问题描述
我注意到，有可能通过PHP运行文件，即使其扩展名是不是的.php ，例如文件 test.xyz。 php.whatever.zyx 可以用PHP可以继续运行，即使扩展名不是的.php ！它只是恰巧有的.php。中的文件名，这足以让我的Apache运行PHP脚本。
I noticed that it's possible to run a file via PHP even if its extension wasn't .php, for example file test.xyz.php.whatever.zyx can be still run with PHP even when the extension isn't .php! It just happens to have .php. in the filename, and that's enough for my Apache to run the PHP script.
我试过（有人建议），把它放到该文件夹在的.htaccess 文件：
I tried (as someone suggested) to put this in a .htaccess file on that folder:
php_flag engine off
但是，这并不在我的机器上运行。
But it didn't work on my machine.
我知道现在唯一的解决方案是：
The only solutions I know for now are:
- 重命名为已知文件的扩展名，这是不通过PHP运行，如
.TXT。 - 从文件名中删除所有的点，从而使其扩展名。
但我还是不知道如何这些解决方案将在其他服务器上不是我的Windows服务器（使用Apache）工作。
But I'm still not sure how these solutions would work on other servers than my Windows server (with Apache).
有其不需要的文件名的任何其他的解决方案，以任何方式被重命名
Is there any other solutions which doesn't need the filenames to be renamed in any way?
推荐答案
要完全安全的，你需要做两件事情：
To be completely secure, you'll need to do a couple of things:
上面设置你的公共文件夹上传目录，使得它从浏览器访问。此设置在php.ini（PHP配置文件）。你需要重新启动Apache，这才会生效。在大多数的Redhat / Fedora的/ CentOS的Web服务器，这可以是：
Set your upload directory above your "public" folder, making it inaccessible from a browser. This setting is in php.ini (php config file). You'll need to restart Apache for this to take effect. On most Redhat / Fedora / CentOS web servers, this can be:
upload_tmp_dir = "/var/tmp/"
或者在我的本地Windows 7安装WAMP，它被设置为：
OR, on my local Windows 7 WAMP install, it is set to:
upload_tmp_dir = "c:/wamp/tmp"
从该目录中运行的脚本禁用（C：/ WAMP的/ tmp），在.htaccess：
RemoveHandler .php .phtml .php3
RemoveType .php .phtml .php3
php_flag engine off
在你的PHP脚本，获取上传的文件，将其过滤基于MIME类型（而不是文件类型的扩展），更改文件名，并把它放到一个安全的可公开访问的文件夹的详细信息：
- 创建文件类型的白名单，例如：仅适用于图像（JPEG，PNG，GIF，BMP）。 mime_content_type（）
- 选择一个新的文件名，往往最好使用基于原始文件名+盐+时间戳随机MD5哈希值。
- 将其移动到公共文件夹，例如：C：/ WAMP / WWW / PROJECT_NAME /公/上传
- create a whitelist of filetypes, ex: only images (jpeg, png, gif, bmp). This can be done using mime_content_type() http://php.net/manual/en/function.mime-content-type.php or the newer finfo_file() http://us3.php.net/manual/en/function.finfo-file.php
- choose a new filename, often it's best to use a random MD5 hash based on the original filename + salt + timestamp.
- move it to a public folder, ex: "c:/wamp/www/project_name/public/uploads"
preferably使用MVC框架，如Zend框架，其中包括文件类型过滤。
如果你做了这一切，你应该是安全的。显然，你永远是100％安全的，因为有无数默默无闻的漏洞特别是在旧系统瞄准PHP，MySQL和命令行等。在较大的公司的Web服务器（什么，我的工作），他们禁止一切，只需要什么项目选择性地启用。有了一个系统，如WAMP，它们使一切，以缓解当地的发展。
If you do all of that, you should be secure. Obviously you'll never be 100% safe, since there are countless obscure exploits targeting PHP, MySQL, the command line, etc, particularly on older systems. On larger company webservers (what I work on), they disable everything, and selectively enable only what is required for the project. With a system such as WAMP, they enable everything, to ease local development.
有关专业的项目工作的良好做法是得到与Rackspace公司或亚马逊云服务器帐户，并了解如何配置php.ini文件，并设置httpd.conf文件，以及PHP安全最佳实践。一般情况下，不信任用户的输入，期望它是腐败/恶意/畸形，并在最终你会是安全的。
Good practice for working on a professional project is to get a cloud server account with Rackspace or Amazon, and learn how to configure php.ini, and httpd.conf settings, as well as PHP security best practices. In general, do not trust the users input, expect it to be corrupt / malicious / malformed, and in the end you'll be secure.
这篇关于如何安全地从通过PHP在任何服务器上运行被prevent上传的文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
