Werk #13322: Limit executable php scripts to NagVis files
Komponente | Site management |
Titel | Limit executable php scripts to NagVis files |
Datum | 12.12.2021 |
Checkmk Edition | Checkmk Raw (CRE) |
Checkmk-Version | 2.1.0b1 |
Level | Kleine Änderung |
Klasse | Sicherheitsfix |
Kompatibilität | Kompatibel - benötigt kein manuelles Eingreifen |
Previously the web server was able to execute .php files from all locations that are callable by the user. With this change, we now limit the execution of php files to the paths we need in the default installation for NagVis.
Please note: In case you intentionally installed php files in your site to access them through the site web server, you may now need to extend your sites web server configuration to make it work again as before.
For example, if you installed one file to var/www/my_script.php, you can make it usable again with the following configuration etc/apache/conf.d/my_script.conf:
<Location "/[site_id]/my_script.php">
Options +ExecCGI
</Location>