IIS 8.5拒绝PHP上传 [英] IIS 8.5 deny PHP upload

问题描述

我在Windows Server 2012 IIS 8.5，最后一个PHP和最后一个MySQL下都有一个WordPress网站。

I have a WordPress website under Windows Server 2012 IIS 8.5, the last PHP, and the last MySQL.

我的WordPress安装（4.7）受到感染，我需要重新安装，更新插件，更改主题等，但是我必须等待响应。

My WordPress installation (4.7) is compromised, I need to reinstall it, update plugins, change themes, etc., but I have to wait for a response.

每天我都会看到一些奇怪的 * .php 文件放在上载文件夹中。如何拒绝该文件夹中的PHP上传？我可以访问Web服务器，并且可以更改所需的内容。

Every day I see some strange *.php files in the uploads folder. How can I deny PHP upload in this folder? I have access to the Web Server, and I can change whatever I want.

也许我可以使用 .htaccess 文件还是什么？

Maybe I can solve it with an .htaccess file or what?

我知道WordPress必须具有对许多文件夹（如上载）的写权限，实际上，如果我拒绝IUSR写入上载文件夹的话。这些文件没有显示，但我无法上传任何内容。我只需要拒绝 *。php 上传。

I know that WordPress must have write access to many folders, like uploads, indeed if I deny IUSR write to uploads folders. Those files do not appear, but I can't upload anything. I just need to deny *.php upload.

推荐答案

限制在Windows Server上使用IIS时，在上传文件夹中执行PHP文件，您只需要在 upload文件夹中上传一个web.config文件，其中包含以下内容：

To restrict PHP files execution in your upload folder when using IIS on windows server, you just need to upload a web.config file in your "upload" folder with below mentioned content:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers>
            <clear />
            <add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
        </handlers>
    </system.webServer>
</configuration>

有关详细说明，请点击此处： http://www.wptricks24.com/disable-php-files-upload-folder-wordpress-iis

For more detailed explanation, just check here: http://www.wptricks24.com/disable-php-files-upload-folder-wordpress-iis

对于遇到的相同情况，这是一篇非常不错的文章。

This is a very nice article for same situation you are facing.

这篇关于IIS 8.5拒绝PHP上传的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！