-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
79 changed files
with
1,631 additions
and
1,268 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| server { | ||
| listen ${NGINX_PORT}; | ||
| server_name localhost; | ||
|
|
||
| root ${NGINX_WEB_ROOT}; | ||
|
|
||
| client_max_body_size ${NGINX_MAX_BODY_SIZE}; | ||
|
|
||
| location = /favicon.ico { | ||
| log_not_found off; | ||
| access_log off; | ||
| } | ||
|
|
||
| location = /robots.txt { | ||
| allow all; | ||
| log_not_found off; | ||
| access_log off; | ||
| } | ||
|
|
||
| location ~* \.(txt|log)$ { | ||
| deny all; | ||
| } | ||
|
|
||
| location ~ \..*/.*\.php$ { | ||
| return 403; | ||
| } | ||
|
|
||
| location ~ ^/sites/.*/private/ { | ||
| return 403; | ||
| } | ||
|
|
||
| # Block access to scripts in site files directory | ||
| location ~ ^/sites/[^/]+/files/.*\.php$ { | ||
| deny all; | ||
| } | ||
|
|
||
| # Block access to "hidden" files and directories whose names begin with a | ||
| # period. | ||
| location ~ (^|/)\. { | ||
| return 403; | ||
| } | ||
|
|
||
| location / { | ||
| try_files $uri /index.php?$query_string; | ||
| } | ||
|
|
||
| location @rewrite { | ||
| rewrite ^ /index.php; | ||
| } | ||
|
|
||
| # Don't allow direct access to PHP files in the vendor directory. | ||
| location ~ /vendor/.*\.php$ { | ||
| deny all; | ||
| return 404; | ||
| } | ||
|
|
||
| # Protect files and directories from prying eyes. | ||
| location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.tar|.gz|.bz2|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ { | ||
| deny all; | ||
| return 404; | ||
| } | ||
|
|
||
| location ~ '\.php$|^/update.php' { | ||
| include fastcgi_params; | ||
|
|
||
| fastcgi_buffers 16 32k; | ||
| fastcgi_buffer_size 64k; | ||
| fastcgi_busy_buffers_size 64k; | ||
|
|
||
| fastcgi_split_path_info ^(.+?\.php)(|/.*)$; | ||
|
|
||
| # Ensure the php file exists. Mitigates CVE-2019-11043 | ||
| try_files $fastcgi_script_name =404; | ||
|
|
||
| fastcgi_param HTTP_PROXY ""; | ||
| fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; | ||
| fastcgi_param PATH_INFO $fastcgi_path_info; | ||
| fastcgi_param QUERY_STRING $query_string; | ||
|
|
||
| fastcgi_intercept_errors on; | ||
| fastcgi_pass ${NGINX_FPM_SERVICE}; | ||
| } | ||
|
|
||
| # Enforce clean URLs | ||
| # | ||
| # Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page | ||
| # Could be done with 301 for permanent or other redirect codes. | ||
| if ($request_uri ~* "^(.*/)index\.php/(.*)") { | ||
| return 307 $1$2; | ||
| } | ||
|
|
||
| error_log /dev/stderr; | ||
| access_log /dev/stdout main; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.