thinkphp配置nginx伪静态并解决PATHINFO问题和fix_pathinfo漏洞

 

nginx.conf的server配置，当文件不存在时，就采用伪静态

server{
    listen 801;
    index  index.html index.htm index.php;
    root D:/data/code/jsjh-admin/wwwroot;
    location /{
        if (!-e $request_filename) {
            rewrite ^(.*)$ /index.php$1 last;
        }
    }
    include dotphp.conf;
}

 

dotphp.conf配置php的PATH_INFO

location ~ (\.php$|\.php/) {
    #定义变量 $path_info ，用于存放pathinfo信息
    set $path_info "";
    #定义变量 $real_script_name，用于存放真实地址
    set $real_script_name $fastcgi_script_name;
    #如果地址与引号内的正则表达式匹配
    if ($fastcgi_script_name ~ "^(.+?\.php)(/.+)$") {
        #将文件地址赋值给变量 $real_script_name
        set $real_script_name $1;
        #将文件地址后的参数赋值给变量 $path_info
        set $path_info $2;
    }
    fastcgi_index index.php;
    include fastcgi_params;#先载入默认的
    #然后在下面加就能覆盖默认的配置
    fastcgi_param SCRIPT_FILENAME $document_root$real_script_name;
    fastcgi_param SCRIPT_NAME $real_script_name;
    fastcgi_param PATH_INFO $path_info;
    if (-e $document_root$real_script_name){
        fastcgi_pass  127.0.0.1:9000;
    }
}

配置php.ini解决nginx文件类型错误解析漏洞

[PHP]
cgi.fix_pathinfo=0;设0可解决nginx文件类型错误解析漏洞

 

转载于:https://www.cnblogs.com/firadio/p/5013316.html